Changeset 52327 in webkit


Ignore:
Timestamp:
Dec 18, 2009 11:43:18 AM (14 years ago)
Author:
eric@webkit.org
Message:

2009-12-18 Kenneth Russell <kbr@google.com>

Reviewed by Darin Fisher.

Index validation for drawElements examines too many indices
https://bugs.webkit.org/show_bug.cgi?id=32692

  • fast/canvas/webgl/bug-32692-expected.txt: Added.
  • fast/canvas/webgl/bug-32692.html: Added.

2009-12-18 Kenneth Russell <kbr@google.com>

Reviewed by Darin Fisher.

Index validation for drawElements examines too many indices
https://bugs.webkit.org/show_bug.cgi?id=32692

Test: fast/canvas/webgl/bug-32692.html

  • html/canvas/WebGLRenderingContext.cpp: (WebCore::WebGLRenderingContext::validateIndexArrayPrecise):
Location:
trunk
Files:
2 added
3 edited

Legend:

Unmodified
Added
Removed
  • trunk/LayoutTests/ChangeLog

    r52326 r52327  
     12009-12-18  Kenneth Russell  <kbr@google.com>
     2
     3        Reviewed by Darin Fisher.
     4
     5        Index validation for drawElements examines too many indices
     6        https://bugs.webkit.org/show_bug.cgi?id=32692
     7
     8        * fast/canvas/webgl/bug-32692-expected.txt: Added.
     9        * fast/canvas/webgl/bug-32692.html: Added.
     10
    1112009-12-18  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
    212
  • trunk/WebCore/ChangeLog

    r52325 r52327  
     12009-12-18  Kenneth Russell  <kbr@google.com>
     2
     3        Reviewed by Darin Fisher.
     4
     5        Index validation for drawElements examines too many indices
     6        https://bugs.webkit.org/show_bug.cgi?id=32692
     7
     8        Test: fast/canvas/webgl/bug-32692.html
     9
     10        * html/canvas/WebGLRenderingContext.cpp:
     11        (WebCore::WebGLRenderingContext::validateIndexArrayPrecise):
     12
    1132009-12-18  Sam Weinig  <sam@webkit.org>
    214
  • trunk/WebCore/html/canvas/WebGLRenderingContext.cpp

    r52205 r52327  
    648648bool WebGLRenderingContext::validateIndexArrayPrecise(unsigned long count, unsigned long type, long offset, long& numElementsRequired)
    649649{
    650     // FIXME: "count" should need to be used in the computation below
    651     UNUSED_PARAM(count);
    652650    long lastIndex = -1;
    653651
    654652    if (!m_boundElementArrayBuffer)
    655653        return false;
    656        
    657     // The GL spec says that count must be "greater
    658    
     654
    659655    unsigned long uoffset = static_cast<unsigned long>(offset);
    660    
     656    unsigned long n = count;
     657
    661658    if (type == GraphicsContext3D::UNSIGNED_SHORT) {
    662659        // Make uoffset an element offset.
    663660        uoffset /= 2;
    664    
    665         unsigned long n = m_boundElementArrayBuffer->byteLength(GraphicsContext3D::ELEMENT_ARRAY_BUFFER) / 2;
    666         const unsigned short* p = static_cast<const unsigned short*>(m_boundElementArrayBuffer->elementArrayBuffer()->data());
     661        const unsigned short* p = static_cast<const unsigned short*>(m_boundElementArrayBuffer->elementArrayBuffer()->data()) + uoffset;
    667662        while (n-- > 0) {
    668663            if (*p > lastIndex)
     
    671666        }
    672667    } else if (type == GraphicsContext3D::UNSIGNED_BYTE) {
    673         unsigned long n = m_boundElementArrayBuffer->byteLength(GraphicsContext3D::ELEMENT_ARRAY_BUFFER);
    674         const unsigned char* p = static_cast<const unsigned char*>(m_boundElementArrayBuffer->elementArrayBuffer()->data());
     668        const unsigned char* p = static_cast<const unsigned char*>(m_boundElementArrayBuffer->elementArrayBuffer()->data()) + uoffset;
    675669        while (n-- > 0) {
    676670            if (*p > lastIndex)
Note: See TracChangeset for help on using the changeset viewer.