Firefox · DOM
CVE-2026-12290
Logic Error in DOM
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
dom/canvas/WebGL2Context.cppdom/canvas/WebGLContext.hdom/canvas/WebGLShaderValidator.cpp
Patch
diff --git a/dom/canvas/WebGL2Context.cpp b/dom/canvas/WebGL2Context.cpp
index bb4abd4abff..ee7c2845c1c 100644
--- a/dom/canvas/WebGL2Context.cpp
+++ b/dom/canvas/WebGL2Context.cpp
@@ -116,6 +116,10 @@ bool WebGLContext::InitWebGL2(FailureReason* const out_failReason) {
gl->GetIntAs<uint32_t>(LOCAL_GL_MIN_PROGRAM_TEXEL_OFFSET);
mGLMaxProgramTexelOffset =
gl->GetIntAs<uint32_t>(LOCAL_GL_MAX_PROGRAM_TEXEL_OFFSET);
+ mGLMaxVertexUniformBlocks =
+ gl->GetIntAs<uint32_t>(LOCAL_GL_MAX_VERTEX_UNIFORM_BLOCKS);
+ mGLMaxFragmentUniformBlocks =
+ gl->GetIntAs<uint32_t>(LOCAL_GL_MAX_FRAGMENT_UNIFORM_BLOCKS);
mIndexedUniformBufferBindings.resize(mLimits->maxUniformBufferBindings);
diff --git a/dom/canvas/WebGLContext.h b/dom/canvas/WebGLContext.h
index 2116e3834e0..8327f63d89a 100644
--- a/dom/canvas/WebGLContext.h
+++ b/dom/canvas/WebGLContext.h
@@ -970,6 +970,8 @@ class WebGLContext : public VRefCounted, public SupportsWeakPtr {
// ES3:
uint32_t mGLMinProgramTexelOffset = 0;
uint32_t mGLMaxProgramTexelOffset = 0;
+ uint32_t mGLMaxVertexUniformBlocks = 0;
+ uint32_t mGLMaxFragmentUniformBlocks = 0;
public:
auto GLMaxDrawBuffers() const { return mLimits->maxColorDrawBuffers; }
diff --git a/dom/canvas/WebGLShaderValidator.cpp b/dom/canvas/WebGLShaderValidator.cpp
index 562a172c135..016f86e7e7e 100644
--- a/dom/canvas/WebGLShaderValidator.cpp
+++ b/dom/canvas/WebGLShaderValidator.cpp
@@ -150,6 +150,8 @@ std::unique_ptr<webgl::ShaderValidator> WebGLContext::CreateShaderValidator(
if (IsWebGL2()) {
resources.MinProgramTexelOffset = mGLMinProgramTexelOffset;
resources.MaxProgramTexelOffset = mGLMaxProgramTexelOffset;
+ resources.MaxVertexUniformBlocks = mGLMaxVertexUniformBlocks;
+ resources.MaxFragmentUniformBlocks = mGLMaxFragmentUniformBlocks;
}
resources.MaxDrawBuffers = MaxValidDrawBuffers();
@@ -212,8 +214,12 @@ std::unique_ptr<webgl::ShaderValidator> WebGLContext::CreateShaderValidator(
// -
- const auto compileOptions =
- webgl::ChooseValidatorCompileOptions(resources, gl);
+ auto compileOptions = webgl::ChooseValidatorCompileOptions(resources, gl);
+
+ if (IsWebGL2()) {
+ compileOptions.validatePerStageMaxUniformBlocks = true;
+ }
+
auto ret = webgl::ShaderValidator::Create(shaderType, spec, outputLanguage,
resources, compileOptions);
if (!ret) return ret;
Loading diff…
References
On This Page