Changeset 207221 in webkit

Timestamp:

Oct 12, 2016 9:50:24 AM (8 years ago)

Author:

Brent Fulgham

Message:

[WebGL] Revise vertex array attribute checks to account for lazy memory allocation.
​https://bugs.webkit.org/show_bug.cgi?id=163149
<rdar://problem/28629774>

Reviewed by Dean Jackson.

Tested by fast/canvas/webgl/webgl-drawarrays-crash-2.html

• html/canvas/WebGLRenderingContextBase.cpp:

(WebCore::WebGLRenderingContextBase::validateVertexAttributes):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• html/canvas/WebGLRenderingContextBase.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2016-10-12  Brent Fulgham  <bfulgham@apple.com>
+
+        [WebGL] Revise vertex array attribute checks to account for lazy memory allocation.
+        https://bugs.webkit.org/show_bug.cgi?id=163149
+        <rdar://problem/28629774>
+
+        Reviewed by Dean Jackson.
+
+        Tested by fast/canvas/webgl/webgl-drawarrays-crash-2.html
+
+        * html/canvas/WebGLRenderingContextBase.cpp:
+        (WebCore::WebGLRenderingContextBase::validateVertexAttributes):
+
 2016-10-12  Wenson Hsieh  <wenson_hsieh@apple.com>
 

trunk/Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp

@@ -1757 +1757 @@
         return false;
 
+    bool usingSimulatedArrayBuffer = m_currentProgram->isUsingVertexAttrib0();
+
     // Guard against access into non-existent buffers.
-    if (elementCount && !sawEnabledAttrib && !m_currentProgram->isUsingVertexAttrib0())
+    if (elementCount && !sawEnabledAttrib && !usingSimulatedArrayBuffer)
         return false;
 
     if (elementCount && sawEnabledAttrib) {
-        if (!m_boundArrayBuffer && !m_boundVertexArrayObject->getElementArrayBuffer())
+        if (!m_boundArrayBuffer && !m_boundVertexArrayObject->getElementArrayBuffer()) {
+            if (usingSimulatedArrayBuffer) {
+                auto& state = m_boundVertexArrayObject->getVertexAttribState(0);
+                if (state.enabled && state.isBound()) {
+                    if (state.bufferBinding->getTarget() == GraphicsContext3D::ARRAY_BUFFER || state.bufferBinding->getTarget() == GraphicsContext3D::ELEMENT_ARRAY_BUFFER)
+                        return !!state.bufferBinding->byteLength();
+                }
+            }
             return false;
+        }
     }