We have to make sure when we set a texture sampler that the value is less than the max combined texture units, otherwise we throw an INVALID_VALUE error. The conformance test, conformance/uniforms/uniform-samplers-test.html, covers this.
Fix relies on https://bugs.webkit.org/show_bug.cgi?id=122607 to be committed first.
Created attachment 213923 [details] Patch
Comment on attachment 213923 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=213923&action=review > Source/WebCore/html/canvas/WebGLRenderingContext.cpp:4170 > + for (unsigned ii = 0; ii < v->length(); ++ii) { Is there a reason for ii vs i here? > Source/WebCore/html/canvas/WebGLRenderingContext.cpp:4171 > + if (((GC3Dint*)v)[ii] >= (int)m_textureUnits.size()) { Might as well use static_cast > Source/WebCore/html/canvas/WebGLRenderingContext.cpp:4189 > + if (location->type() == GraphicsContext3D::SAMPLER_2D || location->type() == GraphicsContext3D::SAMPLER_CUBE) > + for (unsigned ii = 0; ii < (unsigned)size; ++ii) { > + if (((GC3Dint*)v)[ii] >= (int)m_textureUnits.size()) { Same.
(In reply to comment #3) > (From update of attachment 213923 [details]) > View in context: https://bugs.webkit.org/attachment.cgi?id=213923&action=review > > > Source/WebCore/html/canvas/WebGLRenderingContext.cpp:4170 > > + for (unsigned ii = 0; ii < v->length(); ++ii) { > > Is there a reason for ii vs i here? Eh, just saw it in a number of places in the file. There are also plenty of just i's though. I can change. > > > Source/WebCore/html/canvas/WebGLRenderingContext.cpp:4171 > > + if (((GC3Dint*)v)[ii] >= (int)m_textureUnits.size()) { > > Might as well use static_cast > > > Source/WebCore/html/canvas/WebGLRenderingContext.cpp:4189 > > + if (location->type() == GraphicsContext3D::SAMPLER_2D || location->type() == GraphicsContext3D::SAMPLER_CUBE) > > + for (unsigned ii = 0; ii < (unsigned)size; ++ii) { > > + if (((GC3Dint*)v)[ii] >= (int)m_textureUnits.size()) { > > Same. KK
Committed with fixes: http://trac.webkit.org/changeset/157271