Fix buffer overflow error on buffer resize.

We were using the new, larger size for our buffer data copy step, instead of the old, smaller size. This bug was causing a crash on older nVidia drivers during normal browser usage. Reproducible with the index-validation-large-buffer WebGL test. BUG=angle:667 BUG=384420 Change-Id: I98ee893e0d8ba0bfc9adfe5a338da9b940248879 Reviewed-on: https://chromium-review.googlesource.com/203776Tested-by: Jamie Madill <jmadill@chromium.org> Reviewed-by: Shannon Woods <shannonwoods@chromium.org> Reviewed-by: Geoff Lang <geofflang@chromium.org>

Fix buffer overflow error on buffer resize.
4d632d8e · Jamie Madill · f26ecc81 · 4d632d8e
Commit 4d632d8e authored Jun 16, 2014 by Jamie Madill
Hide whitespace changes
Inline Side-by-side

Showing with 4 additions and 1 deletion

BufferStorage11.cpp src/libGLESv2/renderer/d3d11/BufferStorage11.cpp +4 -1

No files found.
--- a/src/libGLESv2/renderer/d3d11/BufferStorage11.cpp
+++ b/src/libGLESv2/renderer/d3d11/BufferStorage11.cpp
@@ -646,9 +646,12 @@ bool BufferStorage11::NativeBuffer11::resize(size_t size, bool preserveData)

    if (mNativeBuffer && preserveData)
    {
+        // We don't call resize if the buffer is big enough already.
+        ASSERT(mBufferSize <= size);
+
        D3D11_BOX srcBox;
        srcBox.left = 0;
-        srcBox.right = size;
+        srcBox.right = mBufferSize;
        srcBox.top = 0;
        srcBox.bottom = 1;
        srcBox.front = 0;