Changeset 51785 in webkit

Timestamp:

Dec 7, 2009 11:36:34 AM (14 years ago)

Author:

eric@webkit.org

Message:

2009-12-07 Kenneth Russell <​kbr@google.com>

Reviewed by Dimitri Glazkov.

[v8] WebCore::WebGLArrayBufferInternal::byteLengthAttrGetter NULL pointer
​https://bugs.webkit.org/show_bug.cgi?id=31889

Fixed bug in handling of zero-argument constructor call.

Test: fast/canvas/webgl/bug-31889.html

• fast/canvas/webgl/bug-31889-expected.txt: Added.
• fast/canvas/webgl/bug-31889.html: Added.

2009-12-07 Kenneth Russell <​kbr@google.com>

Reviewed by Dimitri Glazkov.

[v8] WebCore::WebGLArrayBufferInternal::byteLengthAttrGetter NULL pointer
​https://bugs.webkit.org/show_bug.cgi?id=31889

Fixed bug in handling of zero-argument constructor call.

Test: fast/canvas/webgl/bug-31889.html

• bindings/v8/custom/V8WebGLArrayBufferCustom.cpp: (WebCore::CALLBACK_FUNC_DECL):

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/canvas/webgl/bug-31889-expected.txt (added)
• LayoutTests/fast/canvas/webgl/bug-31889.html (added)
• WebCore/ChangeLog (modified) (1 diff)
• WebCore/bindings/v8/custom/V8WebGLArrayBufferCustom.cpp (modified) (2 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2009-12-07  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [v8] WebCore::WebGLArrayBufferInternal::byteLengthAttrGetter NULL pointer
+        https://bugs.webkit.org/show_bug.cgi?id=31889
+
+        Fixed bug in handling of zero-argument constructor call.
+
+        Test: fast/canvas/webgl/bug-31889.html
+
+        * fast/canvas/webgl/bug-31889-expected.txt: Added.
+        * fast/canvas/webgl/bug-31889.html: Added.
+
 2009-12-07  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 

trunk/WebCore/ChangeLog

@@ +1 @@
+2009-12-07  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [v8] WebCore::WebGLArrayBufferInternal::byteLengthAttrGetter NULL pointer
+        https://bugs.webkit.org/show_bug.cgi?id=31889
+
+        Fixed bug in handling of zero-argument constructor call.
+
+        Test: fast/canvas/webgl/bug-31889.html
+
+        * bindings/v8/custom/V8WebGLArrayBufferCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
 2009-12-07  Gyuyoung Kim  <gyuyoung@gmail.com>
 

trunk/WebCore/bindings/v8/custom/V8WebGLArrayBufferCustom.cpp

@@ -49 +49 @@
         return throwError("DOM object constructor cannot be called as a function.");
 
-    int argLen = args.Length();
-    if (argLen == 0) {
-        // This happens when we return a previously constructed
-        // WebGLArrayBuffer, e.g. from the call to WebGLArray.buffer.
-        // The V8DOMWrapper will set the internal pointer in the
-        // created object. Unfortunately it doesn't look like it's
-        // possible to distinguish between this case and that where
-        // the user calls "new WebGLArrayBuffer()" from JavaScript.
-        return args.Holder();
-    }
+    // If we return a previously constructed WebGLArrayBuffer,
+    // e.g. from the call to WebGLArray.buffer, this code is called
+    // with a zero-length argument list. The V8DOMWrapper will then
+    // set the internal pointer in the newly-created object.
+    // Unfortunately it doesn't look like it's possible to distinguish
+    // between this case and that where the user calls "new
+    // WebGLArrayBuffer()" from JavaScript. To guard against problems,
+    // we always create at least a zero-length WebGLArrayBuffer, even
+    // if it is immediately overwritten by the V8DOMWrapper.
 
     // Supported constructors:
@@ -64 +63 @@
     //   -- create an empty buffer of n bytes
 
-    if (argLen != 1)
+    int argLen = args.Length();
+    if (argLen > 1)
         return throwError("Wrong number of arguments specified to constructor (requires 1)");
 
     int len = 0;
-    if (!args[0]->IsInt32())
-        return throwError("Argument to WebGLArrayBuffer constructor was not an integer");
-    len = toInt32(args[0]);
+    if (argLen > 0) {
+        if (!args[0]->IsInt32())
+            return throwError("Argument to WebGLArrayBuffer constructor was not an integer");
+        len = toInt32(args[0]);
+    }
+
     RefPtr<WebGLArrayBuffer> buffer = WebGLArrayBuffer::create(len);
     // Transform the holder into a wrapper object for the array.