Attachment 339683 Details for Bug 185363 – Patch

[patch] Patch

bug-185363-20180506082059.patch (text/plain), 6.88 KB, created by Dean Jackson on 2018-05-06 08:21:00 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Dean Jackson

Created: 2018-05-06 08:21:00 PDT

Size: 6.88 KB

patch

obsolete

>Subversion Revision: 231232
>diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
>index 15ae40640590e92895bcddf64c74d597fc33b37d..04a8a3e26ed638e53c2b63a4344ea63a5af09809 100644
>--- a/Source/WebCore/ChangeLog
>+++ b/Source/WebCore/ChangeLog
>@@ -1,3 +1,22 @@
>+2018-05-06  Dean Jackson  <dino@apple.com>
>+
>+        WebGL: Reset simulated values after validation fails
>+        https://bugs.webkit.org/show_bug.cgi?id=185363
>+        <rdar://problem/39733417>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        While fixing a previous bug, I forgot to reset some values
>+        when validation fails. This caused a bug where a subsequent
>+        invalid call might use those values and escape detection.
>+
>+        Test: fast/canvas/webgl/index-validation-with-subsequent-draws.html
>+
>+        * html/canvas/WebGLRenderingContextBase.cpp:
>+        (WebCore::WebGLRenderingContextBase::simulateVertexAttrib0): Reset the
>+        sizes when validation fails.
>+        * html/canvas/WebGLRenderingContextBase.h:
>+
> 2018-05-02  Jer Noble  <jer.noble@apple.com>
> 
>         Pipe volume through PlaybackSessionManager/Proxy.
>diff --git a/Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp b/Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp
>index 7875da8de5c9118d03551b3811a2213db7742085..0e5bfa12cbb492998a6d6e086538eed5b6cdd0da 100644
>--- a/Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp
>+++ b/Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp
>@@ -5871,6 +5871,8 @@ std::optional<bool> WebGLRenderingContextBase::simulateVertexAttrib0(GC3Duint nu
>         if (m_context->getError() != GraphicsContext3D::NO_ERROR) {
>             // We were unable to create a buffer.
>             m_vertexAttrib0UsedBefore = false;
>+            m_vertexAttrib0BufferSize = 0;
>+            m_forceAttrib0BufferRefill = true;
>             return std::nullopt;
>         }
>         m_vertexAttrib0BufferSize = bufferDataSize;
>diff --git a/Source/WebCore/html/canvas/WebGLRenderingContextBase.h b/Source/WebCore/html/canvas/WebGLRenderingContextBase.h
>index d2a391959dbc14eecafb0a0e00eb7e889662f7bd..9d80382382da814dc4ca72153ecb22e1caaf237e 100644
>--- a/Source/WebCore/html/canvas/WebGLRenderingContextBase.h
>+++ b/Source/WebCore/html/canvas/WebGLRenderingContextBase.h
>@@ -488,10 +488,10 @@ protected:
>     Vector<VertexAttribValue> m_vertexAttribValue;
>     unsigned m_maxVertexAttribs;
>     RefPtr<WebGLBuffer> m_vertexAttrib0Buffer;
>-    long m_vertexAttrib0BufferSize;
>+    long m_vertexAttrib0BufferSize { 0 };
>     GC3Dfloat m_vertexAttrib0BufferValue[4];
>-    bool m_forceAttrib0BufferRefill;
>-    bool m_vertexAttrib0UsedBefore;
>+    bool m_forceAttrib0BufferRefill { true };
>+    bool m_vertexAttrib0UsedBefore { false };
> 
>     RefPtr<WebGLProgram> m_currentProgram;
>     RefPtr<WebGLFramebuffer> m_framebufferBinding;
>diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
>index c2f64d2955ca45b4f31ddd73fe9d8cc31d394981..31a41ca362eb3173ca9c628d0cc9804fc41530ce 100644
>--- a/LayoutTests/ChangeLog
>+++ b/LayoutTests/ChangeLog
>@@ -1,3 +1,14 @@
>+2018-05-06  Dean Jackson  <dino@apple.com>
>+
>+        WebGL: Reset simulated values after validation fails
>+        https://bugs.webkit.org/show_bug.cgi?id=185363
>+        <rdar://problem/39733417>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * fast/canvas/webgl/index-validation-with-subsequent-draws-expected.txt: Added.
>+        * fast/canvas/webgl/index-validation-with-subsequent-draws.html: Added.
>+
> 2018-05-02  Ms2ger  <Ms2ger@igalia.com>
> 
>         Update document-create-touch.html expectations for r231114
>diff --git a/LayoutTests/fast/canvas/webgl/index-validation-with-subsequent-draws-expected.txt b/LayoutTests/fast/canvas/webgl/index-validation-with-subsequent-draws-expected.txt
>new file mode 100644
>index 0000000000000000000000000000000000000000..a1dd99037c17ed1360cb263c74aefc7bb229ceaa
>--- /dev/null
>+++ b/LayoutTests/fast/canvas/webgl/index-validation-with-subsequent-draws-expected.txt
>@@ -0,0 +1,3 @@
>+CONSOLE MESSAGE: line 50: WebGL: INVALID_OPERATION: drawElements: unable to simulate vertexAttrib0 array
>+CONSOLE MESSAGE: line 56: WebGL: INVALID_OPERATION: drawElements: unable to simulate vertexAttrib0 array
>+
>diff --git a/LayoutTests/fast/canvas/webgl/index-validation-with-subsequent-draws.html b/LayoutTests/fast/canvas/webgl/index-validation-with-subsequent-draws.html
>new file mode 100644
>index 0000000000000000000000000000000000000000..7ab76f011e076b77c2b65f0ba4d649b7ea1ca7a0
>--- /dev/null
>+++ b/LayoutTests/fast/canvas/webgl/index-validation-with-subsequent-draws.html
>@@ -0,0 +1,58 @@
>+<!DOCTYPE html>
>+<html>
>+<script id='2d-vertex-shader' type='x-shader/x-vertex'>
>+    attribute vec4 a_Position; 
>+    void main() { gl_Position = a_Position; }
>+</script>
>+<script id='2d-fragment-shader' type='x-shader/x-fragment'>
>+    void main( void ) {}
>+</script>
>+<body>
>+<canvas id="canvas1" width="20" height="20"></canvas>
>+<script>
>+if (window.testRunner)
>+    testRunner.dumpAsText();
>+
>+// Boilerplate set-up.
>+let canvas = document.getElementById('canvas1');
>+let gl = canvas.getContext('webgl');
>+
>+let vShader = gl.createShader(gl.VERTEX_SHADER);
>+let vShaderScript = document.getElementById('2d-vertex-shader');
>+gl.shaderSource(vShader, vShaderScript.text);
>+gl.compileShader(vShader);
>+
>+let fShader = gl.createShader(gl.FRAGMENT_SHADER);
>+let fShaderScript = document.getElementById('2d-fragment-shader');
>+gl.shaderSource(fShader, fShaderScript.text);
>+gl.compileShader(fShader);
>+
>+let program = gl.createProgram();
>+gl.attachShader(program, vShader);
>+gl.attachShader(program, fShader);
>+gl.linkProgram(program);
>+gl.useProgram(program);
>+
>+gl.getExtension("OES_element_index_uint");
>+let ext = gl.getExtension('ANGLE_instanced_arrays');
>+
>+// Execute a draw that is valid, if strange.
>+let buffer = gl.createBuffer();
>+gl.bindBuffer(gl.ELEMENT_ARRAY_BUFFER, buffer);
>+gl.bufferData(gl.ELEMENT_ARRAY_BUFFER, new Uint8ClampedArray([256, 256, 256, 256]), gl.STATIC_DRAW);
>+ext.drawElementsInstancedANGLE(gl.TRIANGLES, 2, gl.UNSIGNED_SHORT, 0, gl.UNSIGNED_SHORT);
>+
>+// Execute a draw that is invalid because an element index is too large.
>+buffer = gl.createBuffer();
>+gl.bindBuffer(gl.ELEMENT_ARRAY_BUFFER, buffer);
>+gl.bufferData(gl.ELEMENT_ARRAY_BUFFER, new Uint16Array([65536, 137413, 65536, 65536, 65536, 65536, 65536, 65536, 65536, 65536, 65536, 65536, 65536, 65536, 65536]), gl.STATIC_DRAW);
>+gl.bufferSubData(gl.ELEMENT_ARRAY_BUFFER, 10, new Uint8ClampedArray([256, 256, 256, 256, 256, 256]));
>+gl.drawElements(gl.TRIANGLES, 1, gl.UNSIGNED_INT, 0);
>+
>+// Now execute a similarly invalid call, that uses a smaller simulated buffer than the previous invalid call.
>+buffer = gl.createBuffer();
>+gl.bindBuffer(gl.ELEMENT_ARRAY_BUFFER, buffer);
>+gl.bufferData(gl.ELEMENT_ARRAY_BUFFER, new Uint8ClampedArray([256, 256, 256, 256, 256, 256]), gl.STATIC_DRAW);
>+gl.drawElements(gl.TRIANGLES, 1, gl.UNSIGNED_SHORT, 0);
>+</script>
>+</html>
>\ No newline at end of file

Flags:

andersca: review+
ews-watchlist: commit-queue-

Actions: View | Formatted Diff | Diff

Attachments on bug 185363: 339683 | 339684 | 339686 | 339688