Bug 31889

Summary: [v8] WebCore::WebGLArrayBufferInternal::byteLengthAttrGetter NULL pointer
Product: WebKit Reporter: Berend-Jan Wever <skylined>
Component: WebGLAssignee: Kenneth Russell <kbr>
Status: RESOLVED FIXED    
Severity: Normal CC: cmarrin, commit-queue, dglazkov, eric, fishd, simon.fraser, webkit.review.bot
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: All   
OS: All   
URL: http://skypher.com/SkyLined/Repro/WebKit/Bug%2031889%20-%20WebCore..WebGLArrayBufferInternal..byteLengthAttrGetter%20NULL%20pointer/repro.html
Attachments:
Description Flags
Repro
none
Patch none

Berend-Jan Wever
Reported 2009-11-25 13:45:35 PST
Created attachment 43870 [details] Repro Repro: <SCRIPT> new WebGLArrayBuffer().byteLength; </SCRIPT>
Attachments
Repro (57 bytes, text/html)
2009-11-25 13:45 PST, Berend-Jan Wever 		no flags
Details
Patch (5.84 KB, patch)
2009-12-04 19:36 PST, Kenneth Russell 		no flags
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Kenneth Russell
Comment 1 2009-12-03 19:01:47 PST
This is a Chromium-specific bug. There is confusion in the V8 bindings between the case where you fetch a preexisting WebGLArrayBuffer object (for example, WebGLArray.buffer) or call the WebGLArrayBuffer constructor with no arguments (new WebGLArrayBuffer()). As far as I know, there is currently no way to distinguish between these two cases, so we guess incorrectly and end up with a partially initialized JavaScript object. I'll need to consult with the V8 team to understand how to fix this issue. In the interim, I'm lowering this to P2 because it isn't the highest priority issue.
Berend-Jan Wever
Comment 2 2009-12-04 01:33:48 PST
Then maybe we should close this bug and use the Chrome bug (http://code.google.com/p/chromium/issues/detail?id=28821) to track it, or open a new v8 bug?
Kenneth Russell
Comment 3 2009-12-04 19:30:43 PST
This is definitely the right place for this bug since any fix will have to go into the WebKit repository. After looking more at the JSC bindings I see what I was doing incorrectly in the V8 bindings for this constructor. Patch to follow.
Kenneth Russell
Comment 4 2009-12-04 19:36:04 PST
Created attachment 44347 [details] Patch Fixed bug in handling of zero-argument constructor call.
WebKit Review Bot
Comment 5 2009-12-04 19:40:39 PST
style-queue ran check-webkit-style on attachment 44347 [details] without any errors.
Dimitri Glazkov (Google)
Comment 6 2009-12-07 10:44:20 PST
Comment on attachment 44347 [details] Patch r=me.
WebKit Commit Bot
Comment 7 2009-12-07 11:36:43 PST
Comment on attachment 44347 [details] Patch Clearing flags on attachment: 44347 Committed r51785: <http://trac.webkit.org/changeset/51785>
WebKit Commit Bot
Comment 8 2009-12-07 11:36:49 PST
All reviewed patches have been landed. Closing bug.
Note You need to log in before you can comment on or make changes to this bug.