Changeset 53026 in webkit


Ignore:
Timestamp:
Jan 8, 2010 5:02:53 PM (14 years ago)
Author:
eric@webkit.org
Message:

2010-01-08 Kenneth Russell <​kbr@google.com>

Reviewed by Dimitri Glazkov.

Passing array that is too large to set method of WebGLArrays does not throw an exception
​https://bugs.webkit.org/show_bug.cgi?id=33352

Added needed range checks to JSC and V8 custom bindings. Expanded
preexisting test suite for WebGLArrays and updated its expected
results. Tested in WebKit and Chromium.

  • fast/canvas/webgl/array-set-out-of-bounds-expected.txt: Added.
  • fast/canvas/webgl/array-set-out-of-bounds.html: Added.
  • fast/canvas/webgl/array-unit-tests-expected.txt:
  • fast/canvas/webgl/array-unit-tests.html:

2010-01-08 Kenneth Russell <​kbr@google.com>

Reviewed by Dimitri Glazkov.

Passing array that is too large to set method of WebGLArrays does not throw an exception
​https://bugs.webkit.org/show_bug.cgi?id=33352

Added needed range checks to JSC and V8 custom bindings. Expanded
preexisting test suite for WebGLArrays and updated its expected
results. Tested in WebKit and Chromium.

Test: fast/canvas/webgl/array-set-out-of-bounds.html

  • bindings/js/JSWebGLArrayHelper.h: (WebCore::setWebGLArrayFromArray):
  • bindings/v8/custom/V8WebGLArrayCustom.h: (WebCore::setWebGLArrayFromArray):
Location:
trunk
Files:
2 added
6 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r53024 r53026  
     12010-01-08  Kenneth Russell  <kbr@google.com>
     2
     3        Reviewed by Dimitri Glazkov.
     4
     5        Passing array that is too large to set method of WebGLArrays does not throw an exception
     6        https://bugs.webkit.org/show_bug.cgi?id=33352
     7
     8        Added needed range checks to JSC and V8 custom bindings. Expanded
     9        preexisting test suite for WebGLArrays and updated its expected
     10        results. Tested in WebKit and Chromium.
     11
     12        * fast/canvas/webgl/array-set-out-of-bounds-expected.txt: Added.
     13        * fast/canvas/webgl/array-set-out-of-bounds.html: Added.
     14        * fast/canvas/webgl/array-unit-tests-expected.txt:
     15        * fast/canvas/webgl/array-unit-tests.html:
     16
    1172010-01-08  Eric Seidel  <eric@webkit.org>
    218

  • trunk/LayoutTests/fast/canvas/webgl/array-unit-tests-expected.txt

    r53009 r53026  
    1111PASS negativeTest WebGLByteArray SetFromWebGLArray
    1212PASS test WebGLByteArray SetFromArray
     13PASS negativeTest WebGLByteArray SetFromArray
    1314PASS test WebGLByteArray Slice
    1415PASS negativeTest WebGLByteArray Slice
    … …  
    2223PASS negativeTest WebGLFloatArray SetFromWebGLArray
    2324PASS test WebGLFloatArray SetFromArray
     25PASS negativeTest WebGLFloatArray SetFromArray
    2426PASS test WebGLFloatArray Slice
    2527PASS negativeTest WebGLFloatArray Slice
    … …  
    3335PASS negativeTest WebGLIntArray SetFromWebGLArray
    3436PASS test WebGLIntArray SetFromArray
     37PASS negativeTest WebGLIntArray SetFromArray
    3538PASS test WebGLIntArray Slice
    3639PASS negativeTest WebGLIntArray Slice
    … …  
    4447PASS negativeTest WebGLShortArray SetFromWebGLArray
    4548PASS test WebGLShortArray SetFromArray
     49PASS negativeTest WebGLShortArray SetFromArray
    4650PASS test WebGLShortArray Slice
    4751PASS negativeTest WebGLShortArray Slice
    … …  
    5559PASS negativeTest WebGLUnsignedByteArray SetFromWebGLArray
    5660PASS test WebGLUnsignedByteArray SetFromArray
     61PASS negativeTest WebGLUnsignedByteArray SetFromArray
    5762PASS test WebGLUnsignedByteArray Slice
    5863PASS negativeTest WebGLUnsignedByteArray Slice
    … …  
    6671PASS negativeTest WebGLUnsignedIntArray SetFromWebGLArray
    6772PASS test WebGLUnsignedIntArray SetFromArray
     73PASS negativeTest WebGLUnsignedIntArray SetFromArray
    6874PASS test WebGLUnsignedIntArray Slice
    6975PASS negativeTest WebGLUnsignedIntArray Slice
    … …  
    7783PASS negativeTest WebGLUnsignedShortArray SetFromWebGLArray
    7884PASS test WebGLUnsignedShortArray SetFromArray
     85PASS negativeTest WebGLUnsignedShortArray SetFromArray
    7986PASS test WebGLUnsignedShortArray Slice
    8087PASS negativeTest WebGLUnsignedShortArray Slice

  • trunk/LayoutTests/fast/canvas/webgl/array-unit-tests.html

    r53009 r53026  
    3333    exc = currentlyRunning + ': ' + str;
    3434  else
    35     exc = str;
     35    exc = currentlyRunning;
    3636  testFailed(exc);
    3737}
    … …  
    278278    for (var i = 0; i < array2.length; i++) {
    279279      assertEq('Element ' + i, 10 - i, array[i]);
     280    }
     281    pass();
     282  } catch (e) {
     283    fail(e);
     284  }
     285}
     286
     287function negativeTestSetFromArray(type, name) {
     288  running('negativeTest ' + name + ' SetFromArray');
     289  try {
     290    var array = new type([2, 3]);
     291    try {
     292      array.set([4, 5], 1);
     293      fail();
     294      return;
     295    } catch (e) {
     296    }
     297    try {
     298      array.set([4, 5, 6]);
     299      fail();
     300      return;
     301    } catch (e) {
    280302    }
    281303    pass();
    … …  
    431453    negativeTestSetFromWebGLArray(type, name);
    432454    testSetFromArray(type, name);
     455    negativeTestSetFromArray(type, name);
    433456    testSlice(type, name);
    434457    negativeTestSlice(type, name);

  • trunk/WebCore/ChangeLog

    r53023 r53026  
     12010-01-08  Kenneth Russell  <kbr@google.com>
     2
     3        Reviewed by Dimitri Glazkov.
     4
     5        Passing array that is too large to set method of WebGLArrays does not throw an exception
     6        https://bugs.webkit.org/show_bug.cgi?id=33352
     7
     8        Added needed range checks to JSC and V8 custom bindings. Expanded
     9        preexisting test suite for WebGLArrays and updated its expected
     10        results. Tested in WebKit and Chromium.
     11
     12        Test: fast/canvas/webgl/array-set-out-of-bounds.html
     13
     14        * bindings/js/JSWebGLArrayHelper.h:
     15        (WebCore::setWebGLArrayFromArray):
     16        * bindings/v8/custom/V8WebGLArrayCustom.h:
     17        (WebCore::setWebGLArrayFromArray):
     18
    1192010-01-08  Alexey Proskuryakov  <ap@apple.com>
    220

  • trunk/WebCore/bindings/js/JSWebGLArrayHelper.h

    r51051 r53026  
    2828#define JSWebGLArrayHelper_h
    2929
     30#include "ExceptionCode.h"
     31#include "JSDOMBinding.h"
    3032#include <interpreter/CallFrame.h>
    3133#include <runtime/ArgList.h>
    … …  
    4648            offset = args.at(1).toInt32(exec);
    4749        int length = array->get(exec, JSC::Identifier(exec, "length")).toInt32(exec);
    48         for (int i = 0; i < length; i++) {
    49             JSC::JSValue v = array->get(exec, i);
    50             if (exec->hadException())
    51                 return JSC::jsUndefined();
    52             webGLArray->set(i + offset, v.toNumber(exec));
     50        if (offset + length > webGLArray->length())
     51            setDOMException(exec, INDEX_SIZE_ERR);
     52        else {
     53            for (int i = 0; i < length; i++) {
     54                JSC::JSValue v = array->get(exec, i);
     55                if (exec->hadException())
     56                    return JSC::jsUndefined();
     57                webGLArray->set(i + offset, v.toNumber(exec));
     58            }
    5359        }
    5460

  • trunk/WebCore/bindings/v8/custom/V8WebGLArrayCustom.h

    r52058 r53026  
    175175            offset = toInt32(args[1]);
    176176        uint32_t length = toInt32(array->Get(v8::String::New("length")));
    177         for (uint32_t i = 0; i < length; i++) {
    178             webGLArray->set(offset + i, array->Get(v8::Integer::New(i))->NumberValue());
    179         }
     177        if (offset + length > webGLArray->length())
     178            V8Proxy::setDOMException(INDEX_SIZE_ERR);
     179        else
     180            for (uint32_t i = 0; i < length; i++)
     181                webGLArray->set(offset + i, array->Get(v8::Integer::New(i))->NumberValue());
    180182    }
    181183
Note: See TracChangeset for help on using the changeset viewer.