Changeset 52700 in webkit

Timestamp:

Jan 3, 2010 6:40:02 PM (14 years ago)

Author:

eric@webkit.org

Message:

2010-01-03 Kenneth Russell <​kbr@google.com>

Reviewed by Maciej Stachowiak.

Index validation code must always copy client data
​https://bugs.webkit.org/show_bug.cgi?id=32748

Client data must always be copied during bufferData and
bufferSubData calls, because otherwise the data the GL uses to
draw may differ from that checked by the index validation code.

• fast/canvas/webgl/index-validation-copies-indices-expected.txt: Added.
• fast/canvas/webgl/index-validation-copies-indices.html: Added.

2010-01-03 Kenneth Russell <​kbr@google.com>

Reviewed by Maciej Stachowiak.

Index validation code must always copy client data
​https://bugs.webkit.org/show_bug.cgi?id=32748

Client data must always be copied during bufferData and
bufferSubData calls, because otherwise the data the GL uses to
draw may differ from that checked by the index validation code.

Test: fast/canvas/webgl/index-validation-copies-indices.html

• html/canvas/WebGLBuffer.cpp: (WebCore::WebGLBuffer::WebGLBuffer): (WebCore::WebGLBuffer::associateBufferData): (WebCore::WebGLBuffer::associateBufferSubData):
• html/canvas/WebGLBuffer.h:

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/canvas/webgl/index-validation-copies-indices-expected.txt (added)
• LayoutTests/fast/canvas/webgl/index-validation-copies-indices.html (added)
• WebCore/ChangeLog (modified) (1 diff)
• WebCore/html/canvas/WebGLBuffer.cpp (modified) (3 diffs)
• WebCore/html/canvas/WebGLBuffer.h (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2010-01-03  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Index validation code must always copy client data
+        https://bugs.webkit.org/show_bug.cgi?id=32748
+
+        Client data must always be copied during bufferData and
+        bufferSubData calls, because otherwise the data the GL uses to
+        draw may differ from that checked by the index validation code.
+
+        * fast/canvas/webgl/index-validation-copies-indices-expected.txt: Added.
+        * fast/canvas/webgl/index-validation-copies-indices.html: Added.
+
 2010-01-03  Jakub Wieczorek  <faw217@gmail.com>
 

trunk/WebCore/ChangeLog

@@ +1 @@
+2010-01-03  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Index validation code must always copy client data
+        https://bugs.webkit.org/show_bug.cgi?id=32748
+
+        Client data must always be copied during bufferData and
+        bufferSubData calls, because otherwise the data the GL uses to
+        draw may differ from that checked by the index validation code.
+
+        Test: fast/canvas/webgl/index-validation-copies-indices.html
+
+        * html/canvas/WebGLBuffer.cpp:
+        (WebCore::WebGLBuffer::WebGLBuffer):
+        (WebCore::WebGLBuffer::associateBufferData):
+        (WebCore::WebGLBuffer::associateBufferSubData):
+        * html/canvas/WebGLBuffer.h:
+
 2010-01-03  Adam Barth  <abarth@webkit.org>
 

trunk/WebCore/html/canvas/WebGLBuffer.cpp

@@ -47 +47 @@
     , m_elementArrayBufferByteLength(0)
     , m_arrayBufferByteLength(0)
-    , m_elementArrayBufferCloned(false)
     , m_nextAvailableCacheEntry(0)
 {
@@ -90 +89 @@
         clearCachedMaxIndices();
         m_elementArrayBufferByteLength = array->byteLength();
-        m_elementArrayBuffer = array->buffer();
-        m_elementArrayBufferCloned = false;
+        // We must always clone the incoming data because client-side
+        // modifications without calling bufferData or bufferSubData
+        // must never be able to change the validation results.
+        m_elementArrayBuffer = WebGLArrayBuffer::create(array->buffer().get());
         return true;
     }
@@ -118 +119 @@
         if (uoffset > m_elementArrayBufferByteLength || array->byteLength() > m_elementArrayBufferByteLength - uoffset)
             return false;
-            
-        // If we already have a buffer, we need to clone it and add the new data
-        if (m_elementArrayBuffer && !m_elementArrayBufferCloned) {
-            m_elementArrayBuffer = WebGLArrayBuffer::create(m_elementArrayBuffer.get());
-            m_elementArrayBufferCloned = true;
-        }
             
         memcpy(static_cast<unsigned char*>(m_elementArrayBuffer->data()) + offset, array->baseAddress(), array->byteLength());

trunk/WebCore/html/canvas/WebGLBuffer.h

@@ -68 +68 @@
         unsigned m_elementArrayBufferByteLength;
         unsigned m_arrayBufferByteLength;
-        bool m_elementArrayBufferCloned;
 
         // Optimization for index validation. For each type of index