Changeset 195987 in webkit

Timestamp:

Feb 1, 2016, 4:20:37 PM (10 years ago)

Author:

matthew_hanson@apple.com

Message:

Merge r195837. rdar://problem/24002220

Location:

branches/safari-601-branch

Files:

• LayoutTests/ChangeLog (modified) (2 diffs)
• LayoutTests/fast/canvas/webgl/webgl-drawarrays-crash-expected.txt (added)
• LayoutTests/fast/canvas/webgl/webgl-drawarrays-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp (modified) (3 diffs)

branches/safari-601-branch/LayoutTests/ChangeLog

@@ +1 @@
+2016-02-01  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r195837. rdar://problem/24002220
+
+    2015-12-22  Pranjal Jumde  <pjumde@apple.com>
+
+            Test to check for stack recursion when indexed propertyNames defined using Object.defineProperty are deleted.
+            https://bugs.webkit.org/show_bug.cgi?id=149179
+            <rdar://problem/22708019>.
+
+            Reviewed by Dean Jackson.
+
+            * storage/domstorage/localstorage/delete-defineproperty-removal-expected.txt: Added.
+            * storage/domstorage/localstorage/delete-defineproperty-removal.html: Added.
+
+<<<<<<< .mine
+2016-01-29  Brent Fulgham  <bfulgham@apple.com>
+
+        [WebGL] Check vertex array bounds before permitting a glDrawArrays to execute
+        https://bugs.webkit.org/show_bug.cgi?id=153643
+        <rdar://problem/23424456>
+
+        Reviewed by Dean Jackson.
+
+        * fast/canvas/webgl/webgl-drawarrays-crash-expected.txt: Added.
+        * fast/canvas/webgl/webgl-drawarrays-crash.html: Added.
+
+=======
 2016-01-29  Babak Shafiei  <bshafiei@apple.com>
 
@@ -100 +128 @@
                 * loader/stateobjects/pushstate-size-iframe-expected.txt: Added.
                 * loader/stateobjects/pushstate-size-iframe.html: Added.
+>>>>>>> .r195836
                 * loader/stateobjects/pushstate-size.html: Added.
                 * loader/stateobjects/replacestate-size-expected.txt: Added.

branches/safari-601-branch/Source/WebCore/ChangeLog

@@ +1 @@
+2016-02-01  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r195837. rdar://problem/24002220
+
+    2016-01-29  Brent Fulgham  <bfulgham@apple.com>
+
+            [WebGL] Check vertex array bounds before permitting a glDrawArrays to execute
+            https://bugs.webkit.org/show_bug.cgi?id=153643
+            <rdar://problem/23424456>
+
+            Reviewed by Dean Jackson.
+
+            Tested by fast/canvas/webgl/webgl-drawarrays-crash.html.
+
+            * html/canvas/WebGLRenderingContextBase.cpp:
+            (WebCore::WebGLRenderingContextBase::validateDrawArrays): Make sure that we have at
+            least one buffer bound to a program if a drawArray call with a non-zero range of
+            requested data is being made.
+            (WebCore::WebGLRenderingContextBase::validateDrawElements): Drive-by formatting fix.
+
 2016-01-31  Babak Shafiei  <bshafiei@apple.com>
 

branches/safari-601-branch/Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp

@@ -1 +1 @@
 /*
- * Copyright (C) 2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -1737 +1737 @@
         return false;
 
+    // Guard against access into non-existent buffers.
+    if (elementCount && !sawEnabledAttrib && !m_currentProgram->isUsingVertexAttrib0())
+        return false;
+
     return true;
 }
@@ -1809 +1813 @@
 {
     if (isContextLostOrPending() || !validateDrawMode(functionName, mode))
-    return false;
+        return false;
     
     if (!validateStencilSettings(functionName))
-    return false;
+        return false;
     
     switch (type) {