From 7de4e867273dd329a9e72dbcd10f3a4479a846b9 Mon Sep 17 00:00:00 2001 From: Moonchild Date: Fri, 8 Apr 2022 21:54:05 +0200 Subject: [PATCH 1/6] [XPCOM] xpcom/threads misc cleanup --- xpcom/threads/LazyIdleThread.cpp | 13 +++++++++---- xpcom/threads/LazyIdleThread.h | 3 ++- xpcom/threads/nsProcessCommon.cpp | 19 +++++++++++++------ 3 files changed, 24 insertions(+), 11 deletions(-) diff --git a/xpcom/threads/LazyIdleThread.cpp b/xpcom/threads/LazyIdleThread.cpp index d74f515e87..c5c7a5f192 100644 --- a/xpcom/threads/LazyIdleThread.cpp +++ b/xpcom/threads/LazyIdleThread.cpp @@ -137,10 +137,15 @@ LazyIdleThread::EnsureThread() return NS_OK; } - MOZ_ASSERT(!mPendingEventCount, "Shouldn't have events yet!"); - MOZ_ASSERT(!mIdleNotificationCount, "Shouldn't have idle events yet!"); - MOZ_ASSERT(!mIdleTimer, "Should have killed this long ago!"); - MOZ_ASSERT(!mThreadIsShuttingDown, "Should have cleared that!"); +#ifdef DEBUG + { // Lock scope + MutexAutoLock lock(mMutex); + MOZ_ASSERT(!mPendingEventCount, "Shouldn't have events yet!"); + MOZ_ASSERT(!mIdleNotificationCount, "Shouldn't have idle events yet!"); + MOZ_ASSERT(!mIdleTimer, "Should have killed this long ago!"); + MOZ_ASSERT(!mThreadIsShuttingDown, "Should have cleared that!"); + } +#endif nsresult rv; diff --git a/xpcom/threads/LazyIdleThread.h b/xpcom/threads/LazyIdleThread.h index 460971c7a8..9d437171a7 100644 --- a/xpcom/threads/LazyIdleThread.h +++ b/xpcom/threads/LazyIdleThread.h @@ -152,9 +152,10 @@ private: nsCOMPtr mThread; /** - * Protected by mMutex. Created when mThread has no pending events and fired + * Created when mThread has no pending events and fired * at mOwningThread. Any thread that dispatches to mThread will take ownership * of the timer and fire a separate cancel event to the owning thread. + * Only accessed from the owning thread. */ nsCOMPtr mIdleTimer; diff --git a/xpcom/threads/nsProcessCommon.cpp b/xpcom/threads/nsProcessCommon.cpp index e815ec9ea4..7d490c5952 100644 --- a/xpcom/threads/nsProcessCommon.cpp +++ b/xpcom/threads/nsProcessCommon.cpp @@ -280,10 +280,13 @@ nsProcess::ProcessComplete() } const char* topic; - if (mExitValue < 0) { - topic = "process-failed"; - } else { - topic = "process-finished"; + { // Lock scope + MutexAutoLock lock(mLock); + if (mExitValue < 0) { + topic = "process-failed"; + } else { + topic = "process-finished"; + } } mPid = -1; @@ -412,8 +415,11 @@ nsProcess::RunProcess(bool aBlocking, char** aMyArgv, nsIObserver* aObserver, } } - mExitValue = -1; - mPid = -1; + { + MutexAutoLock lock(mLock); + mExitValue = -1; + mPid = -1; + } #if defined(PROCESSMODEL_WINAPI) BOOL retVal; @@ -477,6 +483,7 @@ nsProcess::RunProcess(bool aBlocking, char** aMyArgv, nsIObserver* aObserver, mBlocking = aBlocking; if (aBlocking) { Monitor(this); + MutexAutoLock lock(mLock); if (mExitValue < 0) { return NS_ERROR_FILE_EXECUTION_FAILED; } From 943d76fa91fd868e87fae584343661bf9efcc751 Mon Sep 17 00:00:00 2001 From: Moonchild Date: Fri, 8 Apr 2022 22:55:27 +0200 Subject: [PATCH 2/6] No issue - Avoid WebGL crash on Mesa This prevents too high vert-count draws that Mesa doesn't handle. --- dom/canvas/WebGLContextDraw.cpp | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/dom/canvas/WebGLContextDraw.cpp b/dom/canvas/WebGLContextDraw.cpp index 8e437a07f3..def5fb0ef3 100644 --- a/dom/canvas/WebGLContextDraw.cpp +++ b/dom/canvas/WebGLContextDraw.cpp @@ -1066,6 +1066,15 @@ WebGLContext::DoFakeVertexAttrib0(const char* funcName, GLuint vertexCount) vertexCount = 1; } + if (gl->WorkAroundDriverBugs() && gl->IsMesa()) { + // Padded/strided to vec4, so 4x4bytes. + const auto effectiveVertAttribBytes = CheckedInt(vertexCount) * 4 * 4; + if (!effectiveVertAttribBytes.isValid()) { + ErrorOutOfMemory("`offset + count` too large for Mesa."); + return false; + } + } + const auto whatDoesAttrib0Need = WhatDoesVertexAttrib0Need(); if (MOZ_LIKELY(whatDoesAttrib0Need == WebGLVertexAttrib0Status::Default)) return true; From 260cc45e51501b5a779ac012103295cd99ec56a4 Mon Sep 17 00:00:00 2001 From: Moonchild Date: Sat, 9 Apr 2022 00:31:18 +0200 Subject: [PATCH 3/6] [js] Fix AliasSet of MLoadTypedArrayElementHole --- js/src/jit/MIR.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h index 8fd777d3ee..a398ef3344 100644 --- a/js/src/jit/MIR.h +++ b/js/src/jit/MIR.h @@ -10113,7 +10113,7 @@ class MLoadTypedArrayElementHole return congruentIfOperandsEqual(other); } AliasSet getAliasSet() const override { - return AliasSet::Load(AliasSet::UnboxedElement); + return AliasSet::Load(AliasSet::UnboxedElement | AliasSet::ObjectFields); } bool canProduceFloat32() const override { return arrayType_ == Scalar::Float32; } From 8751960d9a150b8d550e768da73da65731139e5a Mon Sep 17 00:00:00 2001 From: Moonchild Date: Sat, 9 Apr 2022 00:33:41 +0200 Subject: [PATCH 4/6] [XPCOM] xpcom Threadpool cleanup Make sure thread locks are in place to guard accesses. --- xpcom/threads/nsThreadPool.cpp | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/xpcom/threads/nsThreadPool.cpp b/xpcom/threads/nsThreadPool.cpp index ec8f326719..2d852809ab 100644 --- a/xpcom/threads/nsThreadPool.cpp +++ b/xpcom/threads/nsThreadPool.cpp @@ -155,8 +155,6 @@ nsThreadPool::Run() { mThreadNaming.SetThreadPoolName(mName); - LOG(("THRD-P(%p) enter %s\n", this, mName.BeginReading())); - nsCOMPtr current; nsThreadManager::get().GetCurrentThread(getter_AddRefs(current)); @@ -169,6 +167,7 @@ nsThreadPool::Run() { MutexAutoLock lock(mMutex); listener = mListener; + LOG(("THRD-P(%p) enter %s\n", this, mName.BeginReading())); } if (listener) { @@ -223,7 +222,12 @@ nsThreadPool::Run() } } if (event) { - LOG(("THRD-P(%p) %s running [%p]\n", this, mName.BeginReading(), event.get())); +#ifdef DEBUG + { + MutexAutoLock lock(mMutex); + LOG(("THRD-P(%p) %s running [%p]\n", this, mName.BeginReading(), event.get())); + } +#endif event->Run(); } } while (!exitThread); @@ -335,6 +339,7 @@ nsThreadPool::Shutdown() NS_IMETHODIMP nsThreadPool::GetThreadLimit(uint32_t* aValue) { + MutexAutoLock lock(mMutex); *aValue = mThreadLimit; return NS_OK; } @@ -358,6 +363,7 @@ nsThreadPool::SetThreadLimit(uint32_t aValue) NS_IMETHODIMP nsThreadPool::GetIdleThreadLimit(uint32_t* aValue) { + MutexAutoLock lock(mMutex); *aValue = mIdleThreadLimit; return NS_OK; } @@ -382,6 +388,7 @@ nsThreadPool::SetIdleThreadLimit(uint32_t aValue) NS_IMETHODIMP nsThreadPool::GetIdleThreadTimeout(uint32_t* aValue) { + MutexAutoLock lock(mMutex); *aValue = mIdleThreadTimeout; return NS_OK; } @@ -438,11 +445,9 @@ nsThreadPool::SetListener(nsIThreadPoolListener* aListener) NS_IMETHODIMP nsThreadPool::SetName(const nsACString& aName) { - { - MutexAutoLock lock(mMutex); - if (mThreads.Count()) { - return NS_ERROR_NOT_AVAILABLE; - } + MutexAutoLock lock(mMutex); + if (mThreads.Count()) { + return NS_ERROR_NOT_AVAILABLE; } mName = aName; From 168e8bebd0931abbc828298c682e3a4370b1f8d5 Mon Sep 17 00:00:00 2001 From: Moonchild Date: Sat, 9 Apr 2022 01:25:04 +0200 Subject: [PATCH 5/6] [devtools] Restrict sourcemap URLs --- devtools/client/framework/source-map-worker.js | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/devtools/client/framework/source-map-worker.js b/devtools/client/framework/source-map-worker.js index c68732f38e..b6ac2c121f 100644 --- a/devtools/client/framework/source-map-worker.js +++ b/devtools/client/framework/source-map-worker.js @@ -23,6 +23,19 @@ function enableSourceMaps() { function _resolveSourceMapURL(source) { const { url = "", sourceMapURL = "" } = source; + + const UNSUPPORTED_PROTOCOLS = ["chrome://", "resource://"]; + if (path.isURL(sourceMapURL) && UNSUPPORTED_PROTOCOLS.some(protocol => sourceMapURL.startsWith(protocol))) { + // If it's an internal protocol, don't allow it and return empty. + return ""; + } + if (path.isURL(sourceMapURL) && sourceMapURL.startsWith("file://")) { + // Only allow file:// source maps from file:// docs + if (!url.startsWith("file://")) { + return ""; + } + } + if (path.isURL(sourceMapURL) || url == "") { // If it's already a full URL or the source doesn't have a URL, // don't resolve anything. From 15065117ff48bf22672e8f621e3f74fb8d47375d Mon Sep 17 00:00:00 2001 From: Moonchild Date: Sat, 9 Apr 2022 01:59:40 +0200 Subject: [PATCH 6/6] Fix Mesa check + whitespace --- dom/canvas/WebGLContextDraw.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dom/canvas/WebGLContextDraw.cpp b/dom/canvas/WebGLContextDraw.cpp index def5fb0ef3..c0ba20301a 100644 --- a/dom/canvas/WebGLContextDraw.cpp +++ b/dom/canvas/WebGLContextDraw.cpp @@ -1066,7 +1066,7 @@ WebGLContext::DoFakeVertexAttrib0(const char* funcName, GLuint vertexCount) vertexCount = 1; } - if (gl->WorkAroundDriverBugs() && gl->IsMesa()) { + if (gl->WorkAroundDriverBugs() && gl->Vendor() == gl::GLVendor::Nouveau) { // Padded/strided to vec4, so 4x4bytes. const auto effectiveVertAttribBytes = CheckedInt(vertexCount) * 4 * 4; if (!effectiveVertAttribBytes.isValid()) {