From 9a10666941ea4bbec03205609d1b578a749251c6 Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Sat, 13 Aug 2016 23:46:25 -0700
Subject: [PATCH] webgl: Throw an error on readPixels(width < 0 || height < 0)

Otherwise gleam will try to allocate a negative size area for the
result, and we'll panic with oom.
---
 components/script/dom/webglrenderingcontext.rs | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/components/script/dom/webglrenderingcontext.rs b/components/script/dom/webglrenderingcontext.rs
index 24bbb1a9dbba..781b95c60bff 100644
--- a/components/script/dom/webglrenderingcontext.rs
+++ b/components/script/dom/webglrenderingcontext.rs
@@ -1777,6 +1777,10 @@ impl WebGLRenderingContextMethods for WebGLRenderingContext {
             _ => return Ok(self.webgl_error(InvalidOperation)),
         }
 
+        if width < 0 || height < 0 {
+            return Ok(self.webgl_error(InvalidValue));
+        }
+
         let (sender, receiver) = ipc::channel().unwrap();
         self.ipc_renderer
             .send(CanvasMsg::WebGL(WebGLCommand::ReadPixels(x, y, width, height, format, pixel_type, sender)))