Bug 51421 - Initialize to 0 for undefined values in CopyTexImage2D
Summary: Initialize to 0 for undefined values in CopyTexImage2D
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebGL (show other bugs)
Version: 528+ (Nightly build)
Hardware: PC OS X 10.5
: P2 Normal
Assignee: Zhenyao Mo
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2010-12-21 14:40 PST by Zhenyao Mo
Modified: 2010-12-28 13:35 PST (History)
4 users (show)

See Also:


Attachments
Patch (29.72 KB, patch)
2010-12-23 13:18 PST, Zhenyao Mo
no flags Details | Formatted Diff | Diff
Patch (31.17 KB, patch)
2010-12-28 10:17 PST, Zhenyao Mo
no flags Details | Formatted Diff | Diff
Patch (31.17 KB, patch)
2010-12-28 11:33 PST, Zhenyao Mo
kbr: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Zhenyao Mo 2010-12-21 14:40:49 PST
For example, if texture is larger than the currently bound fbo, then the out-of-bounds regions are undefined.  Need to initialize them to 0 to avoid potential information leaking.

Note that if the underlying GL implementation is already resource-safe (like chromium command buffer port), then no need to do it twice.
Comment 1 Zhenyao Mo 2010-12-23 13:18:46 PST
Created attachment 77365 [details]
Patch
Comment 2 Zhenyao Mo 2010-12-23 15:14:28 PST
Test is in sync with khronos.
Comment 3 David Levin 2010-12-24 06:59:56 PST
Comment on attachment 77365 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=77365&action=review

This change would benefit from someone more familiar with the ara looking it over but here are a few minor nits I noticed when I looked briefly.

> WebCore/html/canvas/WebGLFramebuffer.cpp:113
> +void WebGLFramebuffer::setAttachment(unsigned long attachment, WebGLRenderbuffer* rbo)

Don't use abbreviations "rbo".

> WebCore/html/canvas/WebGLFramebuffer.cpp:208
> +    } else if (m_colorAttachment->isTexture()) {

No braces for this single line if statement.

> WebCore/html/canvas/WebGLFramebuffer.h:45
> +    void setAttachment(unsigned long attachment, unsigned long texTarget, WebGLTexture* texture, int level);

In function declarations, don't include variables that don't ad information. (Remove "texture".)

> WebCore/html/canvas/WebGLFramebuffer.h:46
> +    void setAttachment(unsigned long attachment, WebGLRenderbuffer* rbo);

Don't include "rbo".
Comment 4 Kenneth Russell 2010-12-27 21:15:14 PST
Comment on attachment 77365 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=77365&action=review

This mostly looks good. Aside from Dave's nits, a couple of requests / questions.

> WebCore/html/canvas/WebGLRenderingContext.cpp:81
> +        if (start < 0) {
> +            range += start;
> +            start = 0;
> +        }

Is this really the right behavior? Shouldn't the range be reduced by the amount that start is less than zero, regardless of whether end is within sourceRange?

> WebCore/platform/graphics/GraphicsContext3D.h:800
> +    IntSize getInternalBufferSize();

Please rename this to "getInternalFrameBufferSize". Then the comment (which as written doesn't add much) is really unnecessary.

> LayoutTests/fast/canvas/webgl/uninitialized-test.html:128
> +gl.finish();

How about another test which passes down a negative x and y?
Comment 5 Zhenyao Mo 2010-12-28 09:42:41 PST
Comment on attachment 77365 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=77365&action=review

>> WebCore/html/canvas/WebGLRenderingContext.cpp:81
>> +        }
> 
> Is this really the right behavior? Shouldn't the range be reduced by the amount that start is less than zero, regardless of whether end is within sourceRange?

I think the code did exactly what you said.
Comment 6 Kenneth Russell 2010-12-28 10:01:29 PST
Comment on attachment 77365 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=77365&action=review

Would you be willing to upload a revised patch addressing the other issues?

>>> WebCore/html/canvas/WebGLRenderingContext.cpp:81
>>> +        }
>> 
>> Is this really the right behavior? Shouldn't the range be reduced by the amount that start is less than zero, regardless of whether end is within sourceRange?
> 
> I think the code did exactly what you said.

Ah, I see now; sorry about that.
Comment 7 Zhenyao Mo 2010-12-28 10:17:53 PST
Created attachment 77558 [details]
Patch
Comment 8 Zhenyao Mo 2010-12-28 10:20:14 PST
(In reply to comment #7)
> Created an attachment (id=77558) [details]
> Patch

This patch addressed the comments from levin and kbr.  Will sync the added test section (negative x/y) to khronos once it's reviewed here.
Comment 9 Kenneth Russell 2010-12-28 11:11:32 PST
Comment on attachment 77558 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=77558&action=review

> LayoutTests/fast/canvas/webgl/uninitialized-test.html:134
> +var x = -16;
> +var y = -16;

Would it be better to choose different values than 16 here? Will the fact that these are the same magnitude as fboWidth/fboHeight potentially hide bugs?

> LayoutTests/fast/canvas/webgl/uninitialized-test.html:136
> +checkNonZeroPixels(tex, width, height, -x, -y, fboWidth, fboHeight, 255, 0, 0, 255);

Are the x and y coordinates being passed to checkNonZeroPixels correct here? Should they be (0, 0)?
Comment 10 Zhenyao Mo 2010-12-28 11:29:16 PST
(In reply to comment #9)
> (From update of attachment 77558 [details])
> View in context: https://bugs.webkit.org/attachment.cgi?id=77558&action=review
> 
> > LayoutTests/fast/canvas/webgl/uninitialized-test.html:134
> > +var x = -16;
> > +var y = -16;
> 
> Would it be better to choose different values than 16 here? Will the fact that these are the same magnitude as fboWidth/fboHeight potentially hide bugs?

Will revise.

> 
> > LayoutTests/fast/canvas/webgl/uninitialized-test.html:136
> > +checkNonZeroPixels(tex, width, height, -x, -y, fboWidth, fboHeight, 255, 0, 0, 255);
> 
> Are the x and y coordinates being passed to checkNonZeroPixels correct here? Should they be (0, 0)?

I think -x and -y are the correct value here.  Because starting point is (x, y), so the offset is (-x, -y) in the pixel buffer.
Comment 11 Zhenyao Mo 2010-12-28 11:33:08 PST
Created attachment 77565 [details]
Patch
Comment 12 Kenneth Russell 2010-12-28 11:41:18 PST
Comment on attachment 77565 [details]
Patch

Thanks for bearing with my questions. Looks very good. r=me
Comment 13 Zhenyao Mo 2010-12-28 13:35:52 PST
Committed r74720: <http://trac.webkit.org/changeset/74720>