Bug 48635

Summary: fast/canvas/webgl/draw-arrays-out-of-bounds and fast/canvas/webgl/draw-elements-out-of-bounds fail on Mac
Product: WebKit Reporter: Mikhail Naganov <mnaganov>
Component: WebCore JavaScriptAssignee: Nobody <webkit-unassigned>
Status: NEW ---    
Severity: Normal CC: dglazkov, eric, kbr, zmo
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: Mac   
OS: OS X 10.5   
Bug Depends on: 48601    
Bug Blocks:    

Description Mikhail Naganov 2010-10-29 07:28:45 PDT
Actual results on Chromium Mac:

Test of drawArrays with out-of-bounds parameters

On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".

Test empty buffer
PASS context.drawArrays(context.TRIANGLES, 0, 1) generated expected GL error: INVALID_OPERATION.
PASS context.drawArrays(context.TRIANGLES, 0, 10000) generated expected GL error: INVALID_OPERATION.
PASS context.drawArrays(context.TRIANGLES, 0, 10000000000000) generated expected GL error: INVALID_OPERATION.
PASS context.drawArrays(context.TRIANGLES, 0, -1) generated expected GL error: INVALID_VALUE.
FAIL context.drawArrays(context.TRIANGLES, 1, 0) expected: NO_ERROR. Was INVALID_OPERATION.
PASS context.drawArrays(context.TRIANGLES, -1, 0) generated expected GL error: INVALID_VALUE.
PASS context.drawArrays(context.TRIANGLES, 0, 0) generated expected GL error: NO_ERROR.
FAIL context.drawArrays(context.TRIANGLES, 100, 0) expected: NO_ERROR. Was INVALID_OPERATION.
PASS context.drawArrays(context.TRIANGLES, 1, -1) generated expected GL error: INVALID_VALUE.
PASS context.drawArrays(context.TRIANGLES, -1, 1) generated expected GL error: INVALID_VALUE.

Test buffer with 3 float vectors
PASS context.drawArrays(context.TRIANGLES, 0, 3) generated expected GL error: NO_ERROR.
PASS context.drawArrays(0x0009, 0, 3) generated expected GL error: INVALID_ENUM.
PASS context.drawArrays(context.TRIANGLES, 3, 2) generated expected GL error: INVALID_OPERATION.
PASS context.drawArrays(context.TRIANGLES, 0, 10000) generated expected GL error: INVALID_OPERATION.
PASS context.drawArrays(context.TRIANGLES, 0, 10000000000000) generated expected GL error: INVALID_OPERATION.
PASS context.drawArrays(context.TRIANGLES, 0, -1) generated expected GL error: INVALID_VALUE.
PASS context.drawArrays(context.TRIANGLES, -1, 0) generated expected GL error: INVALID_VALUE.
PASS context.drawArrays(context.TRIANGLES, 0, 0) generated expected GL error: NO_ERROR.
FAIL context.drawArrays(context.TRIANGLES, 100, 0) expected: NO_ERROR. Was INVALID_OPERATION.
PASS context.drawArrays(context.TRIANGLES, 1, -1) generated expected GL error: INVALID_VALUE.
PASS context.drawArrays(context.TRIANGLES, -1, 1) generated expected GL error: INVALID_VALUE.

Test buffer with interleaved (3+2) float vectors
PASS context.drawArrays(context.TRIANGLES, 0, 9) generated expected GL error: NO_ERROR.
PASS context.drawArrays(context.TRIANGLES, 0, -500) generated expected GL error: INVALID_VALUE.
PASS context.drawArrays(context.TRIANGLES, -200, 1) generated expected GL error: INVALID_VALUE.
PASS context.drawArrays(context.TRIANGLES, -200, -500) generated expected GL error: INVALID_VALUE.
PASS context.drawArrays(context.TRIANGLES, 0, 0xffffffff) generated expected GL error: INVALID_VALUE.
PASS context.drawArrays(context.TRIANGLES, 0xffffffff, 1) generated expected GL error: INVALID_VALUE.
PASS context.drawArrays(context.TRIANGLES, 0xffffffff, 0xffffffff) generated expected GL error: INVALID_VALUE.
PASS context.drawArrays(context.TRIANGLES, 0, 200) generated expected GL error: INVALID_OPERATION.
PASS context.drawArrays(context.TRIANGLES, 0, 0x7fffffff) generated expected GL error: INVALID_OPERATION.
PASS context.drawArrays(context.TRIANGLES, 0x7fffffff, 1) generated expected GL error: INVALID_OPERATION.
PASS context.drawArrays(context.TRIANGLES, 0x7fffffff, 0x7fffffff) generated expected GL error: INVALID_OPERATION.

PASS successfullyParsed is true

TEST COMPLETE



Test of drawElements with out-of-bounds parameters

On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".

Test empty index buffer
PASS context.drawElements(context.TRIANGLES, 3, context.UNSIGNED_BYTE, 0) generated expected GL error: INVALID_OPERATION.
PASS context.drawElements(context.TRIANGLES, 10000, context.UNSIGNED_BYTE, 0) generated expected GL error: INVALID_OPERATION.
PASS context.drawElements(context.TRIANGLES, 10000000000000, context.UNSIGNED_BYTE, 0) generated expected GL error: INVALID_OPERATION.
PASS context.drawElements(context.TRIANGLES, -1, context.UNSIGNED_BYTE, 0) generated expected GL error: INVALID_VALUE.
PASS context.drawElements(context.TRIANGLES, 1, context.UNSIGNED_BYTE, 0) generated expected GL error: INVALID_OPERATION.
PASS context.drawElements(context.TRIANGLES, 0, context.UNSIGNED_BYTE, -1) generated expected GL error: INVALID_VALUE.
PASS context.drawElements(context.TRIANGLES, 0, context.UNSIGNED_BYTE, 0) generated expected GL error: NO_ERROR.
PASS context.drawElements(context.TRIANGLES, -1, context.UNSIGNED_BYTE, 1) generated expected GL error: INVALID_VALUE.
PASS context.drawElements(context.TRIANGLES, 1, context.UNSIGNED_BYTE, -1) generated expected GL error: INVALID_VALUE.

Test buffer with 3 byte indexes
PASS context.drawElements(context.TRIANGLES, 3, context.UNSIGNED_BYTE, 0) generated expected GL error: NO_ERROR.
PASS context.drawElements(context.TRIANGLES, 3, context.UNSIGNED_INT, 0) generated expected GL error: INVALID_ENUM.
PASS context.drawElements(0x0009, 3, context.UNSIGNED_BYTE, 0) generated expected GL error: INVALID_ENUM.
PASS context.drawElements(context.TRIANGLES, 3, context.UNSIGNED_BYTE, 2) generated expected GL error: INVALID_OPERATION.
PASS context.drawElements(context.TRIANGLES, 10000, context.UNSIGNED_BYTE, 0) generated expected GL error: INVALID_OPERATION.
PASS context.drawElements(context.TRIANGLES, 10000000000000, context.UNSIGNED_BYTE, 0) generated expected GL error: INVALID_OPERATION.
PASS context.drawElements(context.TRIANGLES, -1, context.UNSIGNED_BYTE, 0) generated expected GL error: INVALID_VALUE.
PASS context.drawElements(context.TRIANGLES, 0, context.UNSIGNED_BYTE, -1) generated expected GL error: INVALID_VALUE.
PASS context.drawElements(context.TRIANGLES, -1, context.UNSIGNED_BYTE, 1) generated expected GL error: INVALID_VALUE.
PASS context.drawElements(context.TRIANGLES, 1, context.UNSIGNED_BYTE, -1) generated expected GL error: INVALID_VALUE.
FAIL context.drawElements(context.TRIANGLES, 0, context.UNSIGNED_BYTE, 4) expected: NO_ERROR. Was INVALID_OPERATION.
PASS context.drawElements(context.TRIANGLES, 0xffffffff, context.UNSIGNED_BYTE, 0) generated expected GL error: INVALID_VALUE.
PASS context.drawElements(context.TRIANGLES, 0x7fffffff, context.UNSIGNED_BYTE, 0) generated expected GL error: INVALID_OPERATION.
PASS context.drawElements(context.TRIANGLES, 0x7fffffff, context.UNSIGNED_BYTE, 0x7fffffff) generated expected GL error: INVALID_OPERATION.
PASS context.bufferData(context.ELEMENT_ARRAY_BUFFER, (new Uint8Array([ 3, 0, 1, 2 ])).slice(1), context.STATIC_DRAW) generated expected GL error: NO_ERROR.
PASS context.drawElements(context.TRIANGLES, 3, context.UNSIGNED_BYTE, 0) generated expected GL error: NO_ERROR.
PASS context.bufferSubData(context.ELEMENT_ARRAY_BUFFER, 0, new Uint8Array([ 3, 0, 1])) generated expected GL error: NO_ERROR.
PASS context.drawElements(context.TRIANGLES, 3, context.UNSIGNED_BYTE, 0) generated expected GL error: INVALID_OPERATION.
PASS context.bufferSubData(context.ELEMENT_ARRAY_BUFFER, 0, (new Uint8Array([ 3, 0, 1, 2 ])).slice(1)) generated expected GL error: NO_ERROR.
PASS context.drawElements(context.TRIANGLES, 3, context.UNSIGNED_BYTE, 0) generated expected GL error: NO_ERROR.
PASS context.drawElements(context.TRIANGLES, 0, context.UNSIGNED_BYTE, 0) generated expected GL error: NO_ERROR.

Test buffer with interleaved (3+2) float vectors
PASS context.drawElements(context.TRIANGLES, 9, context.UNSIGNED_SHORT, 0) generated expected GL error: NO_ERROR.
PASS context.drawElements(context.TRIANGLES, 9, context.FLOAT, 0) generated expected GL error: INVALID_ENUM.
PASS context.drawElements(context.TRIANGLES, 9, context.SHORT, 0) generated expected GL error: INVALID_ENUM.
PASS context.drawElements(context.TRIANGLES, 9, context.UNSIGNED_INT, 0) generated expected GL error: INVALID_ENUM.
PASS context.drawElements(context.TRIANGLES, 9, context.UNSIGNED_SHORT, 1000) generated expected GL error: INVALID_OPERATION.
PASS context.drawElements(context.TRIANGLES, 12, context.UNSIGNED_SHORT, 0) generated expected GL error: INVALID_OPERATION.
PASS context.drawElements(context.TRIANGLES, 15, context.UNSIGNED_SHORT, 0) generated expected GL error: INVALID_OPERATION.
PASS context.drawElements(context.TRIANGLES, 18, context.UNSIGNED_SHORT, 0) generated expected GL error: INVALID_OPERATION.
PASS context.drawElements(context.TRIANGLES, 3, context.UNSIGNED_SHORT, 2*15) generated expected GL error: INVALID_OPERATION.
PASS context.drawElements(context.TRIANGLES, 0xffffffff, context.UNSIGNED_SHORT, 0) generated expected GL error: INVALID_VALUE.
PASS context.drawElements(context.TRIANGLES, 0x7fffffff, context.UNSIGNED_SHORT, 0) generated expected GL error: INVALID_OPERATION.
PASS context.drawElements(context.TRIANGLES, 0, context.UNSIGNED_SHORT, 0) generated expected GL error: NO_ERROR.

PASS successfullyParsed is true

TEST COMPLETE
Comment 1 Zhenyao Mo 2010-10-29 09:46:18 PDT
This is weird.  Seems like one part of the patch (the tests) landed whereas the other part (the code fix) hasn't.

However, after a few cycles, the tests began to pass, which means the code landed too.  Really don't understand how this could happen.

CC eric on this.
Comment 2 Zhenyao Mo 2010-10-29 09:49:53 PDT
The original patch that caused the problem is this one: https://bugs.webkit.org/show_bug.cgi?id=48601