Summary: | bufferSubData causes crash in WebGLBuffer::associateBufferSubData | ||||||
---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Kenneth Russell <kbr> | ||||
Component: | WebGL | Assignee: | Kenneth Russell <kbr> | ||||
Status: | RESOLVED FIXED | ||||||
Severity: | Normal | CC: | cmarrin, dglazkov, japhet, oliver, zmo | ||||
Priority: | P2 | ||||||
Version: | 528+ (Nightly build) | ||||||
Hardware: | All | ||||||
OS: | All | ||||||
Attachments: |
|
Description
Kenneth Russell
2010-07-09 16:44:55 PDT
Created attachment 61114 [details]
Patch
From the ChangeLog:
Allocate m_elementArrayBuffer for entry point taking only size. Guard against allocation failures of m_elementArrayBuffer. Guard against any possibility of crashes due to m_elementArrayBuffer being NULL.
Comment on attachment 61114 [details] Patch > case GraphicsContext3D::ELEMENT_ARRAY_BUFFER: > case GraphicsContext3D::ARRAY_BUFFER: > m_byteLength = size; > + if (m_target == GraphicsContext3D::ELEMENT_ARRAY_BUFFER) { > + clearCachedMaxIndices(); > + m_elementArrayBuffer = ArrayBuffer::create(size, 1); > + if (!m_elementArrayBuffer) { > + m_byteLength = 0; > + return false; > + } > + } > return true; > default: > return false; Style nit: exit early if m_target is 0, and remove the switch. (In reply to comment #2) > (From update of attachment 61114 [details]) > > case GraphicsContext3D::ELEMENT_ARRAY_BUFFER: > > case GraphicsContext3D::ARRAY_BUFFER: > > m_byteLength = size; > > + if (m_target == GraphicsContext3D::ELEMENT_ARRAY_BUFFER) { > > + clearCachedMaxIndices(); > > + m_elementArrayBuffer = ArrayBuffer::create(size, 1); > > + if (!m_elementArrayBuffer) { > > + m_byteLength = 0; > > + return false; > > + } > > + } > > return true; > > default: > > return false; > > Style nit: exit early if m_target is 0, and remove the switch. Will make this change in the landed version. Committed r63017: <http://trac.webkit.org/changeset/63017> |