[WebGPU] Crash in WebCore::GPUCanvasContextCocoa::prepareForDisplay

https://bugs.webkit.org/show_bug.cgi?id=269584 <radar://123018719> Reviewed by Tadeu Zagallo. Vector overflow crash reported, only visible index operator inside the callback is this line. * Source/WebCore/html/canvas/GPUCanvasContextCocoa.mm: (WebCore::GPUCanvasContextCocoa::prepareForDisplay): Canonical link: https://commits.webkit.org/274864@main
WebKit · Feb 16, 2024 · 87647c7 · 87647c7
1 parent 95241f7
commit 87647c7
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/Source/WebCore/html/canvas/GPUCanvasContextCocoa.mm b/Source/WebCore/html/canvas/GPUCanvasContextCocoa.mm
@@ -272,6 +272,8 @@ static GPUIntegerCoordinate getCanvasHeight(const GPUCanvasContext::CanvasType&
     ASSERT(m_configuration->frameCount < m_configuration->renderBuffers.size());
 
     m_compositorIntegration->prepareForDisplay([&] {
+        if (m_configuration->frameCount >= m_configuration->renderBuffers.size())
+            return;
         m_layerContentsDisplayDelegate->setDisplayBuffer(m_configuration->renderBuffers[m_configuration->frameCount]);
         m_compositingResultsNeedsUpdating = false;
         m_configuration->frameCount = (m_configuration->frameCount + 1) % m_configuration->renderBuffers.size();