Changeset 51400 in webkit

Timestamp:

Nov 25, 2009 4:44:39 PM (14 years ago)

Author:

eric@webkit.org

Message:

2009-11-25 Kenneth Russell <​kbr@google.com>

Reviewed by Oliver Hunt.

Off-by-one error in index validation for drawElements and drawArrays
​https://bugs.webkit.org/show_bug.cgi?id=31891

Fixed computation of number of elements for bound array objects.

Test: fast/canvas/webgl/index-validation.html

• fast/canvas/webgl/index-validation-expected.txt: Added.
• fast/canvas/webgl/index-validation.html: Added.
• fast/canvas/webgl/script-tests/index-validation.js: Added.

2009-11-25 Kenneth Russell <​kbr@google.com>

Reviewed by Oliver Hunt.

Off-by-one error in index validation for drawElements and drawArrays
​https://bugs.webkit.org/show_bug.cgi?id=31891

Fixed computation of number of elements for bound array objects.

Test: fast/canvas/webgl/index-validation.html

• html/canvas/WebGLRenderingContext.cpp: (WebCore::WebGLRenderingContext::vertexAttribPointer):

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/canvas/webgl/index-validation-expected.txt (added)
• LayoutTests/fast/canvas/webgl/index-validation.html (added)
• LayoutTests/fast/canvas/webgl/script-tests/index-validation.js (added)
• WebCore/ChangeLog (modified) (1 diff)
• WebCore/html/canvas/WebGLRenderingContext.cpp (modified) (2 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2009-11-25  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        Off-by-one error in index validation for drawElements and drawArrays
+        https://bugs.webkit.org/show_bug.cgi?id=31891
+
+        Fixed computation of number of elements for bound array objects.
+
+        Test: fast/canvas/webgl/index-validation.html
+
+        * fast/canvas/webgl/index-validation-expected.txt: Added.
+        * fast/canvas/webgl/index-validation.html: Added.
+        * fast/canvas/webgl/script-tests/index-validation.js: Added.
+
 2009-11-25  Csaba Osztrogonác  <ossy@webkit.org>
 

trunk/WebCore/ChangeLog

@@ +1 @@
+2009-11-25  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        Off-by-one error in index validation for drawElements and drawArrays
+        https://bugs.webkit.org/show_bug.cgi?id=31891
+
+        Fixed computation of number of elements for bound array objects.
+
+        Test: fast/canvas/webgl/index-validation.html
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::vertexAttribPointer):
+
 2009-11-25  Dmitry Titov  <dimich@chromium.org>
 

trunk/WebCore/html/canvas/WebGLRenderingContext.cpp

@@ -2047 +2047 @@
 {
     if (!m_boundArrayBuffer || indx >= m_maxVertexAttribs) {
+        // FIXME: raise GL_INVALID_VALUE error
         ec = INVALID_STATE_ERR;
         return;
@@ -2059 +2060 @@
     if (ec != 0)
         return;
-        
+    long validatedStride = bytesPerElement;
     if (stride != 0) {
         if ((long) stride < bytesPerElement) {
+            // FIXME: raise GL_INVALID_VALUE error
             ec = SYNTAX_ERR;
             return;
         }
         
-        bytesPerElement = stride;
-    }
-        
-    m_vertexAttribState[indx].numElements = (m_boundArrayBuffer->byteLength(GraphicsContext3D::ARRAY_BUFFER) - offset) / bytesPerElement;
+        validatedStride = stride;
+    }
+        
+    // Avoid off-by-one errors in numElements computation.
+    // For the last element, we will only touch the data for the
+    // element and nothing beyond it.
+    long bytesRemaining = m_boundArrayBuffer->byteLength(GraphicsContext3D::ARRAY_BUFFER) - offset;
+    if (bytesRemaining < bytesPerElement)
+        m_vertexAttribState[indx].numElements = 0;
+    else
+        m_vertexAttribState[indx].numElements = 1 + (bytesRemaining - bytesPerElement) / validatedStride;
 
     m_context->vertexAttribPointer(indx, size, type, normalized, stride, offset);