Changeset 116374 in webkit


Ignore:
Timestamp:
May 7, 2012 4:56:47 PM (12 years ago)
Author:
zmo@google.com
Message:

vertexAttribPointer needs to reject large negative offsets
​https://bugs.webkit.org/show_bug.cgi?id=85117

Reviewed by Kenneth Russell.

Source/WebCore:

  • html/canvas/WebGLRenderingContext.cpp: Use long long for GLsizeiptr and GLintptr

(WebCore):
(WebCore::WebGLRenderingContext::bufferData):
(WebCore::WebGLRenderingContext::bufferSubData):
(WebCore::WebGLRenderingContext::drawElements):
(WebCore::WebGLRenderingContext::getVertexAttribOffset):
(WebCore::WebGLRenderingContext::vertexAttribPointer):

  • html/canvas/WebGLRenderingContext.h: Ditto

(WebGLRenderingContext):

  • html/canvas/WebGLRenderingContext.idl: Ditto

LayoutTests:

  • fast/canvas/webgl/index-validation-expected.txt:
  • fast/canvas/webgl/index-validation.html: Add a test case for large negative offset.
Location:
trunk
Files:
7 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r116373 r116374  
     12012-05-04  Zhenyao Mo  <zmo@google.com>
     2
     3        vertexAttribPointer needs to reject large negative offsets
     4        https://bugs.webkit.org/show_bug.cgi?id=85117
     5
     6        Reviewed by Kenneth Russell.
     7
     8        * fast/canvas/webgl/index-validation-expected.txt:
     9        * fast/canvas/webgl/index-validation.html: Add a test case for large negative offset.
     10
    1112012-05-07  Pravin D  <pravind.2k4@gmail.com>
    212

  • trunk/LayoutTests/fast/canvas/webgl/index-validation-expected.txt

    r116232 r116374  
    55Testing with valid indices
    66PASS gl.checkFramebufferStatus(gl.FRAMEBUFFER) is gl.FRAMEBUFFER_COMPLETE
    7 PASS gl.getError() is 0
     7PASS getError was expected value: NO_ERROR :
    88PASS gl.drawElements(gl.TRIANGLES, 3, gl.UNSIGNED_SHORT, 0) is undefined.
    9 PASS gl.getError() is 0
     9PASS getError was expected value: NO_ERROR :
    1010Testing with out-of-range indices
    1111Enable vertices, valid
    12 PASS gl.getError() is 0
     12PASS getError was expected value: NO_ERROR :
    1313PASS gl.drawElements(gl.TRIANGLES, 3, gl.UNSIGNED_SHORT, 0) is undefined.
    14 PASS gl.getError() is 0
     14PASS getError was expected value: NO_ERROR :
    1515Enable normals, out-of-range
    16 PASS gl.getError() is 0
     16PASS getError was expected value: NO_ERROR :
    1717PASS gl.drawElements(gl.TRIANGLES, 3, gl.UNSIGNED_SHORT, 0) is undefined.
    18 PASS gl.getError() is gl.INVALID_OPERATION
     18PASS getError was expected value: INVALID_OPERATION :
    1919Test with enabled attribute that does not belong to current program
    2020Enable an extra attribute with null
    21 PASS gl.getError() is 0
     21PASS getError was expected value: NO_ERROR :
    2222PASS gl.drawElements(gl.TRIANGLES, 3, gl.UNSIGNED_SHORT, 0) is undefined.
    23 PASS gl.getError() is gl.INVALID_OPERATION
     23PASS getError was expected value: INVALID_OPERATION :
    2424Enable an extra attribute with insufficient data buffer
    25 PASS gl.getError() is 0
     25PASS getError was expected value: NO_ERROR :
    2626PASS gl.drawElements(gl.TRIANGLES, 3, gl.UNSIGNED_SHORT, 0) is undefined.
    27 PASS gl.getError() is 0
     27Pass large negative index to vertexAttribPointer
     28PASS getError was expected value: INVALID_VALUE :
     29PASS gl.drawElements(gl.TRIANGLES, 3, gl.UNSIGNED_SHORT, 0) is undefined.
    2830PASS successfullyParsed is true
    2931

  • trunk/LayoutTests/fast/canvas/webgl/index-validation.html

    r116232 r116374  
     1<!DOCTYPE html>
    12<html>
    23<head>
     4<meta charset="utf-8">
     5<link rel="stylesheet" href="../../js/resources/js-test-style.css"/>
    36<script src="../../js/resources/js-test-pre.js"></script>
    47<script src="resources/webgl-test.js"></script>
    … …  
    6164gl.enableVertexAttribArray(normalLoc);
    6265shouldBe('gl.checkFramebufferStatus(gl.FRAMEBUFFER)', 'gl.FRAMEBUFFER_COMPLETE');
    63 shouldBe('gl.getError()', '0');
     66glErrorShouldBe(gl, gl.NO_ERROR);
    6467shouldBeUndefined('gl.drawElements(gl.TRIANGLES, 3, gl.UNSIGNED_SHORT, 0)');
    65 shouldBe('gl.getError()', '0');
     68glErrorShouldBe(gl, gl.NO_ERROR);
    6669
    6770debug("Testing with out-of-range indices");
    … …  
    7477gl.disableVertexAttribArray(normalLoc);
    7578debug("Enable vertices, valid");
    76 shouldBe('gl.getError()', '0');
     79glErrorShouldBe(gl, gl.NO_ERROR);
    7780shouldBeUndefined('gl.drawElements(gl.TRIANGLES, 3, gl.UNSIGNED_SHORT, 0)');
    78 shouldBe('gl.getError()', '0');
     81glErrorShouldBe(gl, gl.NO_ERROR);
    7982debug("Enable normals, out-of-range");
    8083gl.vertexAttribPointer(normalLoc, 3, gl.FLOAT, false, 7 * sizeInBytes(gl.FLOAT), 4 * sizeInBytes(gl.FLOAT));
    8184gl.enableVertexAttribArray(normalLoc);
    82 shouldBe('gl.getError()', '0');
     85glErrorShouldBe(gl, gl.NO_ERROR);
    8386shouldBeUndefined('gl.drawElements(gl.TRIANGLES, 3, gl.UNSIGNED_SHORT, 0)');
    84 shouldBe('gl.getError()', 'gl.INVALID_OPERATION');
     87glErrorShouldBe(gl, gl.INVALID_OPERATION);
    8588
    8689debug("Test with enabled attribute that does not belong to current program");
    … …  
    9093gl.enableVertexAttribArray(extraLoc);
    9194debug("Enable an extra attribute with null");
    92 shouldBe('gl.getError()', '0');
     95glErrorShouldBe(gl, gl.NO_ERROR);
    9396shouldBeUndefined('gl.drawElements(gl.TRIANGLES, 3, gl.UNSIGNED_SHORT, 0)');
    94 shouldBe('gl.getError()', 'gl.INVALID_OPERATION');
     97glErrorShouldBe(gl, gl.INVALID_OPERATION);
    9598debug("Enable an extra attribute with insufficient data buffer");
    9699gl.vertexAttribPointer(extraLoc, 3, gl.FLOAT, false, 7 * sizeInBytes(gl.FLOAT), 4 * sizeInBytes(gl.FLOAT));
    97 shouldBe('gl.getError()', '0');
     100glErrorShouldBe(gl, gl.NO_ERROR);
    98101shouldBeUndefined('gl.drawElements(gl.TRIANGLES, 3, gl.UNSIGNED_SHORT, 0)');
    99 shouldBe('gl.getError()', '0');
     102debug("Pass large negative index to vertexAttribPointer");
     103gl.vertexAttribPointer(normalLoc, 3, gl.FLOAT, false, 7 * sizeInBytes(gl.FLOAT), -2000000000 * sizeInBytes(gl.FLOAT));
     104glErrorShouldBe(gl, gl.INVALID_VALUE);
     105shouldBeUndefined('gl.drawElements(gl.TRIANGLES, 3, gl.UNSIGNED_SHORT, 0)');
     106
     107successfullyParsed = true;
    100108</script>
    101109

  • trunk/Source/WebCore/ChangeLog

    r116373 r116374  
     12012-05-04  Zhenyao Mo  <zmo@google.com>
     2
     3        vertexAttribPointer needs to reject large negative offsets
     4        https://bugs.webkit.org/show_bug.cgi?id=85117
     5
     6        Reviewed by Kenneth Russell.
     7
     8        * html/canvas/WebGLRenderingContext.cpp: Use long long for GLsizeiptr and GLintptr
     9        (WebCore):
     10        (WebCore::WebGLRenderingContext::bufferData):
     11        (WebCore::WebGLRenderingContext::bufferSubData):
     12        (WebCore::WebGLRenderingContext::drawElements):
     13        (WebCore::WebGLRenderingContext::getVertexAttribOffset):
     14        (WebCore::WebGLRenderingContext::vertexAttribPointer):
     15        * html/canvas/WebGLRenderingContext.h: Ditto
     16        (WebGLRenderingContext):
     17        * html/canvas/WebGLRenderingContext.idl: Ditto
     18
    1192012-05-07  Pravin D  <pravind.2k4@gmail.com>
    220

  • trunk/Source/WebCore/html/canvas/WebGLRenderingContext.cpp

    r116232 r116374  
    10371037}
    10381038
    1039 void WebGLRenderingContext::bufferData(GC3Denum target, GC3Dsizeiptr size, GC3Denum usage, ExceptionCode& ec)
     1039void WebGLRenderingContext::bufferData(GC3Denum target, long long size, GC3Denum usage, ExceptionCode& ec)
    10401040{
    10411041    UNUSED_PARAM(ec);
    … …  
    10501050    }
    10511051    if (!isErrorGeneratedOnOutOfBoundsAccesses()) {
    1052         if (!buffer->associateBufferData(size)) {
     1052        if (!buffer->associateBufferData(static_cast<GC3Dsizeiptr>(size))) {
    10531053            synthesizeGLError(GraphicsContext3D::INVALID_VALUE, "bufferData", "invalid buffer");
    10541054            return;
    … …  
    10561056    }
    10571057
    1058     m_context->bufferData(target, size, usage);
     1058    m_context->bufferData(target, static_cast<GC3Dsizeiptr>(size), usage);
    10591059    cleanupAfterGraphicsCall(false);
    10601060}
    … …  
    11061106}
    11071107
    1108 void WebGLRenderingContext::bufferSubData(GC3Denum target, GC3Dintptr offset, ArrayBuffer* data, ExceptionCode& ec)
     1108void WebGLRenderingContext::bufferSubData(GC3Denum target, long long offset, ArrayBuffer* data, ExceptionCode& ec)
    11091109{
    11101110    UNUSED_PARAM(ec);
    … …  
    11211121        return;
    11221122    if (!isErrorGeneratedOnOutOfBoundsAccesses()) {
    1123         if (!buffer->associateBufferSubData(offset, data)) {
     1123        if (!buffer->associateBufferSubData(static_cast<GC3Dintptr>(offset), data)) {
    11241124            synthesizeGLError(GraphicsContext3D::INVALID_VALUE, "bufferSubData", "offset out of range");
    11251125            return;
    … …  
    11271127    }
    11281128
    1129     m_context->bufferSubData(target, offset, data->byteLength(), data->data());
    1130     cleanupAfterGraphicsCall(false);
    1131 }
    1132 
    1133 void WebGLRenderingContext::bufferSubData(GC3Denum target, GC3Dintptr offset, ArrayBufferView* data, ExceptionCode& ec)
     1129    m_context->bufferSubData(target, static_cast<GC3Dintptr>(offset), data->byteLength(), data->data());
     1130    cleanupAfterGraphicsCall(false);
     1131}
     1132
     1133void WebGLRenderingContext::bufferSubData(GC3Denum target, long long offset, ArrayBufferView* data, ExceptionCode& ec)
    11341134{
    11351135    UNUSED_PARAM(ec);
    … …  
    11461146        return;
    11471147    if (!isErrorGeneratedOnOutOfBoundsAccesses()) {
    1148         if (!buffer->associateBufferSubData(offset, data)) {
     1148        if (!buffer->associateBufferSubData(static_cast<GC3Dintptr>(offset), data)) {
    11491149            synthesizeGLError(GraphicsContext3D::INVALID_VALUE, "bufferSubData", "offset out of range");
    11501150            return;
    … …  
    11521152    }
    11531153
    1154     m_context->bufferSubData(target, offset, data->byteLength(), data->baseAddress());
     1154    m_context->bufferSubData(target, static_cast<GC3Dintptr>(offset), data->byteLength(), data->baseAddress());
    11551155    cleanupAfterGraphicsCall(false);
    11561156}
    … …  
    18991899}
    19001900
    1901 void WebGLRenderingContext::drawElements(GC3Denum mode, GC3Dsizei count, GC3Denum type, GC3Dintptr offset, ExceptionCode& ec)
     1901void WebGLRenderingContext::drawElements(GC3Denum mode, GC3Dsizei count, GC3Denum type, long long offset, ExceptionCode& ec)
    19021902{
    19031903    UNUSED_PARAM(ec);
    … …  
    19341934    if (!isErrorGeneratedOnOutOfBoundsAccesses()) {
    19351935        // Ensure we have a valid rendering state
    1936         if (!validateElementArraySize(count, type, offset)) {
     1936        if (!validateElementArraySize(count, type, static_cast<GC3Dintptr>(offset))) {
    19371937            synthesizeGLError(GraphicsContext3D::INVALID_OPERATION, "drawElements", "request out of bounds for current ELEMENT_ARRAY_BUFFER");
    19381938            return;
    … …  
    19411941            return;
    19421942        if (!validateIndexArrayConservative(type, numElements) || !validateRenderingState(numElements)) {
    1943             if (!validateIndexArrayPrecise(count, type, offset, numElements) || !validateRenderingState(numElements)) {
     1943            if (!validateIndexArrayPrecise(count, type, static_cast<GC3Dintptr>(offset), numElements) || !validateRenderingState(numElements)) {
    19441944                synthesizeGLError(GraphicsContext3D::INVALID_OPERATION, "drawElements", "attempt to access out of bounds arrays");
    19451945                return;
    … …  
    19621962    if (!isGLES2Compliant()) {
    19631963        if (!numElements)
    1964             validateIndexArrayPrecise(count, type, offset, numElements);
     1964            validateIndexArrayPrecise(count, type, static_cast<GC3Dintptr>(offset), numElements);
    19651965        vertexAttrib0Simulated = simulateVertexAttrib0(numElements);
    19661966    }
    19671967    if (!isGLES2NPOTStrict())
    19681968        handleNPOTTextures(true);
    1969     m_context->drawElements(mode, count, type, offset);
     1969    m_context->drawElements(mode, count, type, static_cast<GC3Dintptr>(offset));
    19701970    if (!isGLES2Compliant() && vertexAttrib0Simulated)
    19711971        restoreStatesAfterVertexAttrib0Simulation();
    … …  
    30393039}
    30403040
    3041 GC3Dsizeiptr WebGLRenderingContext::getVertexAttribOffset(GC3Duint index, GC3Denum pname)
     3041long long WebGLRenderingContext::getVertexAttribOffset(GC3Duint index, GC3Denum pname)
    30423042{
    30433043    if (isContextLost())
    … …  
    30453045    GC3Dsizeiptr result = m_context->getVertexAttribOffset(index, pname);
    30463046    cleanupAfterGraphicsCall(false);
    3047     return result;
     3047    return static_cast<long long>(result);
    30483048}
    30493049
    … …  
    42514251}
    42524252
    4253 void WebGLRenderingContext::vertexAttribPointer(GC3Duint index, GC3Dint size, GC3Denum type, GC3Dboolean normalized, GC3Dsizei stride, GC3Dintptr offset, ExceptionCode& ec)
     4253void WebGLRenderingContext::vertexAttribPointer(GC3Duint index, GC3Dint size, GC3Denum type, GC3Dboolean normalized, GC3Dsizei stride, long long offset, ExceptionCode& ec)
    42544254{
    42554255    UNUSED_PARAM(ec);
    … …  
    42854285        return;
    42864286    }
    4287     if ((stride % typeSize) || (offset % typeSize)) {
     4287    if ((stride % typeSize) || (static_cast<GC3Dintptr>(offset) % typeSize)) {
    42884288        synthesizeGLError(GraphicsContext3D::INVALID_OPERATION, "vertexAttribPointer", "stride or offset not valid for type");
    42894289        return;
    … …  
    43014301    state.stride = validatedStride;
    43024302    state.originalStride = stride;
    4303     state.offset = offset;
    4304     m_context->vertexAttribPointer(index, size, type, normalized, stride, offset);
     4303    state.offset = static_cast<GC3Dintptr>(offset);
     4304    m_context->vertexAttribPointer(index, size, type, normalized, stride, static_cast<GC3Dintptr>(offset));
    43054305    cleanupAfterGraphicsCall(false);
    43064306}

  • trunk/Source/WebCore/html/canvas/WebGLRenderingContext.h

    r116232 r116374  
    9797    void blendFuncSeparate(GC3Denum srcRGB, GC3Denum dstRGB, GC3Denum srcAlpha, GC3Denum dstAlpha);
    9898
    99     void bufferData(GC3Denum target, GC3Dsizeiptr size, GC3Denum usage, ExceptionCode&);
     99    void bufferData(GC3Denum target, long long size, GC3Denum usage, ExceptionCode&);
    100100    void bufferData(GC3Denum target, ArrayBuffer* data, GC3Denum usage, ExceptionCode&);
    101101    void bufferData(GC3Denum target, ArrayBufferView* data, GC3Denum usage, ExceptionCode&);
    102     void bufferSubData(GC3Denum target, GC3Dintptr offset, ArrayBuffer* data, ExceptionCode&);
    103     void bufferSubData(GC3Denum target, GC3Dintptr offset, ArrayBufferView* data, ExceptionCode&);
     102    void bufferSubData(GC3Denum target, long long offset, ArrayBuffer* data, ExceptionCode&);
     103    void bufferSubData(GC3Denum target, long long offset, ArrayBufferView* data, ExceptionCode&);
    104104
    105105    GC3Denum checkFramebufferStatus(GC3Denum target);
    … …  
    142142    void disableVertexAttribArray(GC3Duint index, ExceptionCode&);
    143143    void drawArrays(GC3Denum mode, GC3Dint first, GC3Dsizei count, ExceptionCode&);
    144     void drawElements(GC3Denum mode, GC3Dsizei count, GC3Denum type, GC3Dintptr offset, ExceptionCode&);
     144    void drawElements(GC3Denum mode, GC3Dsizei count, GC3Denum type, long long offset, ExceptionCode&);
    145145
    146146    void enable(GC3Denum cap);
    … …  
    175175    PassRefPtr<WebGLUniformLocation> getUniformLocation(WebGLProgram*, const String&, ExceptionCode&);
    176176    WebGLGetInfo getVertexAttrib(GC3Duint index, GC3Denum pname, ExceptionCode&);
    177     GC3Dsizeiptr getVertexAttribOffset(GC3Duint index, GC3Denum pname);
     177    long long getVertexAttribOffset(GC3Duint index, GC3Denum pname);
    178178
    179179    void hint(GC3Denum target, GC3Denum mode);
    … …  
    282282    void vertexAttrib4fv(GC3Duint index, GC3Dfloat* values, GC3Dsizei size);
    283283    void vertexAttribPointer(GC3Duint index, GC3Dint size, GC3Denum type, GC3Dboolean normalized,
    284                              GC3Dsizei stride, GC3Dintptr offset, ExceptionCode&);
     284                             GC3Dsizei stride, long long offset, ExceptionCode&);
    285285
    286286    void viewport(GC3Dint x, GC3Dint y, GC3Dsizei width, GC3Dsizei height);

  • trunk/Source/WebCore/html/canvas/WebGLRenderingContext.idl

    r116232 r116374  
    464464        [StrictTypeChecking] void         bufferData(in unsigned long target, in ArrayBuffer data, in unsigned long usage) raises (DOMException);
    465465        [StrictTypeChecking] void         bufferData(in unsigned long target, in ArrayBufferView data, in unsigned long usage) raises (DOMException);
    466         [StrictTypeChecking] void         bufferData(in unsigned long target, in long size, in unsigned long usage) raises (DOMException);
    467         [StrictTypeChecking] void         bufferSubData(in unsigned long target, in long offset, in ArrayBuffer data) raises (DOMException);
    468         [StrictTypeChecking] void         bufferSubData(in unsigned long target, in long offset, in ArrayBufferView data) raises (DOMException);
     466        [StrictTypeChecking] void         bufferData(in unsigned long target, in long long size, in unsigned long usage) raises (DOMException);
     467        [StrictTypeChecking] void         bufferSubData(in unsigned long target, in long long offset, in ArrayBuffer data) raises (DOMException);
     468        [StrictTypeChecking] void         bufferSubData(in unsigned long target, in long long offset, in ArrayBufferView data) raises (DOMException);
    469469
    470470        [StrictTypeChecking] unsigned long checkFramebufferStatus(in unsigned long target);
    … …  
    508508        [StrictTypeChecking] void         disableVertexAttribArray(in unsigned long index) raises(DOMException);
    509509        [StrictTypeChecking] void         drawArrays(in unsigned long mode, in long first, in long count) raises(DOMException);
    510         [StrictTypeChecking] void         drawElements(in unsigned long mode, in long count, in unsigned long type, in long offset) raises(DOMException);
     510        [StrictTypeChecking] void         drawElements(in unsigned long mode, in long count, in unsigned long type, in long long offset) raises(DOMException);
    511511
    512512        [StrictTypeChecking] void         enable(in unsigned long cap);
    … …  
    568568        [StrictTypeChecking, Custom] void getVertexAttrib();
    569569
    570         [StrictTypeChecking] long getVertexAttribOffset(in unsigned long index, in unsigned long pname);
     570        [StrictTypeChecking] long long getVertexAttribOffset(in unsigned long index, in unsigned long pname);
    571571
    572572        [StrictTypeChecking] void         hint(in unsigned long target, in unsigned long mode);
    … …  
    662662        [StrictTypeChecking, Custom] void         vertexAttrib4fv(in unsigned long indx, in Float32Array values);
    663663        [StrictTypeChecking] void         vertexAttribPointer(in unsigned long indx, in long size, in unsigned long type, in boolean normalized,
    664                                                               in long stride, in long offset) raises(DOMException);
     664                                                              in long stride, in long long offset) raises(DOMException);
    665665
    666666        [StrictTypeChecking] void         viewport(in long x, in long y, in long width, in long height);
Note: See TracChangeset for help on using the changeset viewer.