Changeset 62961 in webkit

Timestamp:

Jul 9, 2010 9:43:38 AM (14 years ago)

Author:

kbr@google.com

Message:

2010-07-09 Kenneth Russell <​kbr@google.com>

Reviewed by Dimitri Glazkov.

Crash with uniform array test
​https://bugs.webkit.org/show_bug.cgi?id=36028

• bindings/v8/custom/V8WebGLRenderingContextCustom.cpp: (WebCore::vertexAttribAndUniformHelperf): (WebCore::uniformHelperi): (WebCore::uniformMatrixHelper):
  • Fixed type tests and casting of incoming arrays.
• html/canvas/WebGLRenderingContext.cpp: (WebCore::WebGLRenderingContext::getUniform):
  • Fixed crash when null WebGLUniform is passed to getUniform.

2010-07-09 Kenneth Russell <​kbr@google.com>

Reviewed by Dimitri Glazkov.

Crash with uniform array test
​https://bugs.webkit.org/show_bug.cgi?id=36028

• fast/canvas/webgl/gl-uniform-arrays-expected.txt:
  • Updated test expectations.
• fast/canvas/webgl/gl-uniform-arrays.html:
  • Separated calling wrong uniform*fv entry point from calling with non-array.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/canvas/webgl/gl-uniform-arrays-expected.txt (modified) (3 diffs)
• LayoutTests/fast/canvas/webgl/gl-uniform-arrays.html (modified) (5 diffs)
• WebCore/ChangeLog (modified) (1 diff)
• WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp (modified) (3 diffs)
• WebCore/html/canvas/WebGLRenderingContext.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2010-07-09  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Crash with uniform array test
+        https://bugs.webkit.org/show_bug.cgi?id=36028
+
+        * fast/canvas/webgl/gl-uniform-arrays-expected.txt:
+         - Updated test expectations.
+        * fast/canvas/webgl/gl-uniform-arrays.html:
+         - Separated calling wrong uniform*fv entry point from calling with non-array.
+
 2010-07-09  Chris Fleizach  <cfleizach@apple.com>
 

trunk/LayoutTests/fast/canvas/webgl/gl-uniform-arrays-expected.txt

@@ -43 +43 @@
 PASS value put in ([12, 11]) matches value pulled out ([12, 11])
 PASS using the wrong size of gl.Uniform fails
+PASS passing non-array to glUniform*fv should throw TypeError
 PASS can call gl.useProgram(null)
 
@@ -63 +64 @@
 PASS value put in ([10, 9, 8]) matches value pulled out ([10, 9, 8])
 PASS using the wrong size of gl.Uniform fails
+PASS passing non-array to glUniform*fv should throw TypeError
 PASS can call gl.useProgram(null)
 
@@ -83 +85 @@
 PASS value put in ([8, 7, 6, 5]) matches value pulled out ([8, 7, 6, 5])
 PASS using the wrong size of gl.Uniform fails
+PASS passing non-array to glUniform*fv should throw TypeError
 PASS can call gl.useProgram(null)
 

trunk/LayoutTests/fast/canvas/webgl/gl-uniform-arrays.html

@@ -91 +91 @@
     elem: '',
     numSrcValues: 3,
-    badSet: function(loc) {
+    invalidSet: function(loc) {
       gl.uniform2fv(loc, [1, 2]);
     },
@@ -114 +114 @@
     elem: '[1]',
     numSrcValues: 3,
-    badSet: function(loc) {
+    invalidSet: function(loc) {
       gl.uniform1fv(loc, [2]);
+    },
+    illegalSet: function(loc) {
+      gl.uniform1fv(loc, 2);
     },
     srcValueAsString: function(index, srcValues) {
@@ -141 +144 @@
     elem: '[2]',
     numSrcValues: 3,
-    badSet: function(loc) {
+    invalidSet: function(loc) {
       gl.uniform1fv(loc, [2]);
+    },
+    illegalSet: function(loc) {
+      gl.uniform1fv(loc, 2);
     },
     srcValueAsString: function(index, srcValues) {
@@ -171 +177 @@
     elem: '[3]',
     numSrcValues: 3,
-    badSet: function(loc) {
+    invalidSet: function(loc) {
       gl.uniform1fv(loc, [2]);
+    },
+    illegalSet: function(loc) {
+      gl.uniform1fv(loc, 2);
     },
     srcValueAsString: function(index, srcValues) {
@@ -249 +258 @@
               typeInfo.returnValueAsString(value) + ")");
   }
-  typeInfo.badSet(loc);
+  typeInfo.invalidSet(loc);
   assertMsg(gl.getError() == gl.INVALID_OPERATION,
             "using the wrong size of gl.Uniform fails");
+  var exceptionCaught = false;
+  if (typeInfo.illegalSet) {
+    try {
+      typeInfo.illegalSet(loc);
+    } catch (e) {
+      exceptionCaught = true;
+    }
+    assertMsg(exceptionCaught, "passing non-array to glUniform*fv should throw TypeError");
+  }
 
   gl.useProgram(null);

trunk/WebCore/ChangeLog

@@ +1 @@
+2010-07-09  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Crash with uniform array test
+        https://bugs.webkit.org/show_bug.cgi?id=36028
+
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        (WebCore::vertexAttribAndUniformHelperf):
+        (WebCore::uniformHelperi):
+        (WebCore::uniformMatrixHelper):
+         - Fixed type tests and casting of incoming arrays.
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::getUniform):
+         - Fixed crash when null WebGLUniform is passed to getUniform.
+
 2010-07-09  Chris Fleizach  <cfleizach@apple.com>
 

trunk/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp

@@ -478 +478 @@
     }
 
+    if (args[1].IsEmpty() || !args[1]->IsArray()) {
+        V8Proxy::throwTypeError();
+        return notHandledByInterceptor();
+    }
     v8::Handle<v8::Array> array =
       v8::Local<v8::Array>::Cast(args[1]);
-    if (array.IsEmpty()) {
-        V8Proxy::setDOMException(SYNTAX_ERR);
-        return notHandledByInterceptor();
-    }
     uint32_t len = array->Length();
     float* data = jsArrayToFloatArray(array, len);
@@ -546 +546 @@
     }
 
+    if (args[1].IsEmpty() || !args[1]->IsArray()) {
+        V8Proxy::throwTypeError();
+        return notHandledByInterceptor();
+    }
     v8::Handle<v8::Array> array =
       v8::Local<v8::Array>::Cast(args[1]);
-    if (array.IsEmpty()) {
-        V8Proxy::setDOMException(SYNTAX_ERR);
-        return notHandledByInterceptor();
-    }
     uint32_t len = array->Length();
     int* data = jsArrayToIntArray(array, len);
@@ -659 +659 @@
     }
 
+    if (args[2].IsEmpty() || !args[2]->IsArray()) {
+        V8Proxy::throwTypeError();
+        return notHandledByInterceptor();
+    }
     v8::Handle<v8::Array> array =
       v8::Local<v8::Array>::Cast(args[2]);
-    if (array.IsEmpty()) {
-        V8Proxy::setDOMException(SYNTAX_ERR);
-        return notHandledByInterceptor();
-    }
     uint32_t len = array->Length();
     float* data = jsArrayToFloatArray(array, len);

trunk/WebCore/html/canvas/WebGLRenderingContext.cpp

@@ -1558 +1558 @@
     if (!validateWebGLObject(program))
         return WebGLGetInfo();
+    if (!uniformLocation) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return WebGLGetInfo();
+    }
     if (uniformLocation->program() != program) {
         m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);