Commit a168145a authored by Sunny Sachanandani's avatar Sunny Sachanandani Committed by Commit Bot

gpu: Check that dcomp surface nullptr dereference crash

Consider two windows (surfaces) one with DC layers enabled (A) and the
other disabled (B) and these sequence of events:

1) MakeCurrent with B
2) SetDrawRectangle on B. |g_current_surface| is null since B doesn't
   have a |dcomp_surface_| and B's |draw_texture_| is |swap_chain_| back
   buffer.
3) MakeCurrent on A
4) SetDrawRectangle on A. |g_current_surface| is A's |dcomp_surface_|.
5) MakeCurrent on B before SwapBuffers on A so that |g_current_surface|
   is not null

We will enter the `if (g_current_surface != dcomp_surface_.Get())`
branch and then `if (draw_texture_)` branch which will cause this crash.

The fix is to check that |dcomp_surface_| is not null before calling
ResumeDraw().

Bug: 1055909
Change-Id: I2d14d0713a51474ca757125a99a525b14ee0a568
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2090028
Auto-Submit: Sunny Sachanandani <sunnyps@chromium.org>
Reviewed-by: default avatarZhenyao Mo <zmo@chromium.org>
Commit-Queue: Sunny Sachanandani <sunnyps@chromium.org>
Cr-Commit-Position: refs/heads/master@{#747457}
parent c9fba810
......@@ -217,7 +217,9 @@ bool DirectCompositionChildSurfaceWin::OnMakeCurrent(GLContext* context) {
}
g_current_surface = nullptr;
}
if (draw_texture_) {
// We're in the middle of |dcomp_surface_| draw only if |draw_texture_| is
// not null.
if (dcomp_surface_ && draw_texture_) {
HRESULT hr = dcomp_surface_->ResumeDraw();
if (FAILED(hr)) {
DLOG(ERROR) << "ResumeDraw failed with error " << std::hex << hr;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment