Changeset 53509 in webkit

Timestamp:

Jan 19, 2010 4:58:55 PM (14 years ago)

Author:

mrowe@apple.com

Message:

<rdar://problem/7555330> <​http://webkit.org/b/33770> dataFunctionMatrix leaks the array allocated by toArray

Reviewed by Oliver Hunt.

Rework toArray to extract elements in to a vector rather than handing out raw pointers. This prevents
callers from forgetting to free the memory, and gives them the option of using stack buffers for
sufficiently small allocations.

• bindings/js/JSWebGLRenderingContextCustom.cpp:

(WebCore::JSWebGLRenderingContext::texSubImage2D):
(WebCore::toVector):
(WebCore::dataFunctionf):
(WebCore::dataFunctioni):
(WebCore::dataFunctionMatrix):

Location:

trunk/WebCore

Files:

• ChangeLog (modified) (1 diff)
• bindings/js/JSWebGLRenderingContextCustom.cpp (modified) (4 diffs)

trunk/WebCore/ChangeLog

@@ +1 @@
+2010-01-19  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/7555330> <http://webkit.org/b/33770> dataFunctionMatrix leaks the array allocated by toArray
+
+        Rework toArray to extract elements in to a vector rather than handing out raw pointers.  This prevents
+        callers from forgetting to free the memory, and gives them the option of using stack buffers for
+        sufficiently small allocations.
+
+        * bindings/js/JSWebGLRenderingContextCustom.cpp:
+        (WebCore::JSWebGLRenderingContext::texSubImage2D):
+        (WebCore::toVector):
+        (WebCore::dataFunctionf):
+        (WebCore::dataFunctioni):
+        (WebCore::dataFunctionMatrix):
+
 2010-01-19  Carol Szabo  <carol.szabo@nokia.com>
 

trunk/WebCore/bindings/js/JSWebGLRenderingContextCustom.cpp

@@ -503 +503 @@
     
     setDOMException(exec, ec);
-    return jsUndefined();    
-}
-
-template<typename T>
-void toArray(JSC::ExecState* exec, JSC::JSValue value, T*& array, int& size)
-{
-    array = 0;
-    
+    return jsUndefined();
+}
+
+template<typename T, size_t inlineCapacity>
+bool toVector(JSC::ExecState* exec, JSC::JSValue value, Vector<T, inlineCapacity>& vector)
+{
     if (!value.isObject())
-        return;
-        
+        return false;
+
     JSC::JSObject* object = asObject(value);
-    int length = object->get(exec, JSC::Identifier(exec, "length")).toInt32(exec);
-    void* tempValues;
-    if (!tryFastMalloc(length * sizeof(T)).getValue(tempValues))
-        return;
-    
-    T* values = static_cast<T*>(tempValues);
-    for (int i = 0; i < length; ++i) {
+    int32_t length = object->get(exec, JSC::Identifier(exec, "length")).toInt32(exec);
+    vector.resize(length);
+
+    for (int32_t i = 0; i < length; ++i) {
         JSC::JSValue v = object->get(exec, i);
         if (exec->hadException())
-            return;
-        values[i] = static_cast<T>(v.toNumber(exec));
-    }
-
-    array = values;
-    size = length;
+            return false;
+        vector[i] = static_cast<T>(v.toNumber(exec));
+    }
+
+    return true;
 }
 
@@ -591 +585 @@
         return jsUndefined();
     }
-    
-    float* array;
-    int size;
-    toArray<float>(exec, args.at(1), array, size);
-    
-    if (!array)
+
+    Vector<float, 64> array;
+    if (!toVector(exec, args.at(1), array))
         return throwError(exec, TypeError);
 
-    switch(f) {
-        case f_uniform1v: context->uniform1fv(location, array, size, ec); break;
-        case f_uniform2v: context->uniform2fv(location, array, size, ec); break;
-        case f_uniform3v: context->uniform3fv(location, array, size, ec); break;
-        case f_uniform4v: context->uniform4fv(location, array, size, ec); break;
-        case f_vertexAttrib1v: context->vertexAttrib1fv(index, array, size); break;
-        case f_vertexAttrib2v: context->vertexAttrib2fv(index, array, size); break;
-        case f_vertexAttrib3v: context->vertexAttrib3fv(index, array, size); break;
-        case f_vertexAttrib4v: context->vertexAttrib4fv(index, array, size); break;
+    switch (f) {
+        case f_uniform1v: context->uniform1fv(location, array.data(), array.size(), ec); break;
+        case f_uniform2v: context->uniform2fv(location, array.data(), array.size(), ec); break;
+        case f_uniform3v: context->uniform3fv(location, array.data(), array.size(), ec); break;
+        case f_uniform4v: context->uniform4fv(location, array.data(), array.size(), ec); break;
+        case f_vertexAttrib1v: context->vertexAttrib1fv(index, array.data(), array.size()); break;
+        case f_vertexAttrib2v: context->vertexAttrib2fv(index, array.data(), array.size()); break;
+        case f_vertexAttrib3v: context->vertexAttrib3fv(index, array.data(), array.size()); break;
+        case f_vertexAttrib4v: context->vertexAttrib4fv(index, array.data(), array.size()); break;
     }
     
@@ -641 +632 @@
         return jsUndefined();
     }
-    
-    int* array;
-    int size;
-    toArray<int>(exec, args.at(1), array, size);
-    
-    if (!array)
+
+
+    Vector<int, 64> array;
+    if (!toVector(exec, args.at(1), array))
         return throwError(exec, TypeError);
 
-    switch(f) {
-        case f_uniform1v: context->uniform1iv(location, array, size, ec); break;
-        case f_uniform2v: context->uniform2iv(location, array, size, ec); break;
-        case f_uniform3v: context->uniform3iv(location, array, size, ec); break;
-        case f_uniform4v: context->uniform4iv(location, array, size, ec); break;
+    switch (f) {
+        case f_uniform1v: context->uniform1iv(location, array.data(), array.size(), ec); break;
+        case f_uniform2v: context->uniform2iv(location, array.data(), array.size(), ec); break;
+        case f_uniform3v: context->uniform3iv(location, array.data(), array.size(), ec); break;
+        case f_uniform4v: context->uniform4iv(location, array.data(), array.size(), ec); break;
         default: break;
     }
@@ -690 +679 @@
         return jsUndefined();
     }
-    
-    float* array;
-    int size;
-    toArray<float>(exec, args.at(2), array, size);
-    
-    if (!array)
+
+    Vector<float, 64> array;
+    if (!toVector(exec, args.at(2), array))
         return throwError(exec, TypeError);
 
-    switch(f) {
-        case f_uniformMatrix2fv: context->uniformMatrix2fv(location, transpose, array, size, ec); break;
-        case f_uniformMatrix3fv: context->uniformMatrix3fv(location, transpose, array, size, ec); break;
-        case f_uniformMatrix4fv: context->uniformMatrix4fv(location, transpose, array, size, ec); break;
-    }
-    
+    switch (f) {
+        case f_uniformMatrix2fv: context->uniformMatrix2fv(location, transpose, array.data(), array.size(), ec); break;
+        case f_uniformMatrix3fv: context->uniformMatrix3fv(location, transpose, array.data(), array.size(), ec); break;
+        case f_uniformMatrix4fv: context->uniformMatrix4fv(location, transpose, array.data(), array.size(), ec); break;
+    }
+
     setDOMException(exec, ec);
     return jsUndefined();