Bug 29230
| Summary: | Need to ensure that incorrect parameters and types are never sent to OpenGL from WebGL | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Chris Marrin <cmarrin> |
| Component: | WebGL | Assignee: | Chris Marrin <cmarrin> |
| Status: | RESOLVED WONTFIX | ||
| Severity: | Normal | CC: | bfulgham, dino, ilmari.heikkinen, jdarpinian, kbr, simon.fraser, zmo |
| Priority: | P2 | ||
| Version: | 528+ (Nightly build) | ||
| Hardware: | PC | ||
| OS: | OS X 10.5 | ||
| Bug Depends on: | 38145, 40175, 41095, 41574 | ||
| Bug Blocks: | |||
Chris Marrin
Passing badly typed uniform or vertex data to OpenGL can cause some drivers to crash. We need to do sufficient checks to prevent that from happening. For instance, passing a vertexAttribPointer as UNSIGNED_BYTE with 3 values when the value is actually FLOAT with 2 values will crash some hardware and not others. likewise, passing UNSIGNED_BYTE with 3 values to a vertexAttrib of type vec4 will crash some hardware.
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Ilmari Heikkinen
These tests written against the Firefox GL canvas might be helpful: http://github.com/kig/canvas3d-tests
Zhenyao Mo
I think after all the dependency patches land, the only thing left unchecked is vertexArreibPointer()'s "type". GL_FIXED is a valid enum for type in GLES2, but it's not supported in GL. I think we should add in the spec that FIXED is not allowed in WebGL.
Kenneth Russell
The WebGL spec has been updated to explicitly state that the GL_FIXED data type is not supported.
Brent Fulgham
Dean - I think we can close this based on the specification change.
Kenneth Russell
Closing this old bug. WebKit's ANGLE backend, which is a conformant ES 2.0 / 3.0 implementation, has conclusively fixed this.