Diff
Copied: branches/chromium/874/LayoutTests/fast/canvas/webgl/shader-deleted-by-accessor-expected.txt (from rev 95728, trunk/LayoutTests/fast/canvas/webgl/shader-deleted-by-accessor-expected.txt) (0 => 95808)
--- branches/chromium/874/LayoutTests/fast/canvas/webgl/shader-deleted-by-accessor-expected.txt (rev 0)
+++ branches/chromium/874/LayoutTests/fast/canvas/webgl/shader-deleted-by-accessor-expected.txt 2011-09-23 16:09:36 UTC (rev 95808)
@@ -0,0 +1,8 @@
+Verifies that WebGLRenderingContext::getAttachedShaders doesn't crash when an accessor property is defined on Array.prototype.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Copied: branches/chromium/874/LayoutTests/fast/canvas/webgl/shader-deleted-by-accessor.html (from rev 95728, trunk/LayoutTests/fast/canvas/webgl/shader-deleted-by-accessor.html) (0 => 95808)
--- branches/chromium/874/LayoutTests/fast/canvas/webgl/shader-deleted-by-accessor.html (rev 0)
+++ branches/chromium/874/LayoutTests/fast/canvas/webgl/shader-deleted-by-accessor.html 2011-09-23 16:09:36 UTC (rev 95808)
@@ -0,0 +1,51 @@
+<html>
+<head>
+<link rel="stylesheet" href=""
+<script src=""
+<script src=""
+<script src=""
+</head>
+<body>
+<div id="description"></div>
+<div id="console"></div>
+
+<script>
+function gc()
+{
+ if (window.GCController)
+ return GCController.collect();
+
+ for (var i = 0; i < 10000; ++i)
+ var s = new String("AAAA");
+}
+
+description("Verifies that WebGLRenderingContext::getAttachedShaders doesn't crash when an accessor property is defined on Array.prototype.");
+
+context = create3DContext();
+program = context.createProgram();
+
+shader1 = context.createShader(context.VERTEX_SHADER);
+context.attachShader(program, shader1);
+
+for (var i = 0; i < 10; ++i) {
+ shader2 = context.createShader(context.FRAGMENT_SHADER);
+ context.attachShader(program, shader2);
+
+ Array.prototype.__defineSetter__(0, function() {
+ context.detachShader(program, shader2);
+ context.deleteShader(shader2);
+ shader2 = null;
+ gc();
+ });
+
+ shaders = context.getAttachedShaders(program);
+ context.getShaderParameter(shaders[1], 0);
+}
+
+successfullyParsed = true;
+</script>
+
+<script src=""
+</body>
+</html>
+
Modified: branches/chromium/874/Source/WebCore/bindings/js/JSWebGLRenderingContextCustom.cpp (95807 => 95808)
--- branches/chromium/874/Source/WebCore/bindings/js/JSWebGLRenderingContextCustom.cpp 2011-09-23 15:57:13 UTC (rev 95807)
+++ branches/chromium/874/Source/WebCore/bindings/js/JSWebGLRenderingContextCustom.cpp 2011-09-23 16:09:36 UTC (rev 95808)
@@ -212,7 +212,7 @@
WebGLProgram* program = toWebGLProgram(exec->argument(0));
if (exec->hadException())
return jsNull();
- Vector<WebGLShader*> shaders;
+ Vector<RefPtr<WebGLShader> > shaders;
bool succeed = context->getAttachedShaders(program, shaders, ec);
if (ec) {
setDOMException(exec, ec);
@@ -222,7 +222,7 @@
return jsNull();
MarkedArgumentBuffer list;
for (size_t ii = 0; ii < shaders.size(); ++ii)
- list.append(toJS(exec, globalObject(), shaders[ii]));
+ list.append(toJS(exec, globalObject(), shaders[ii].get()));
return constructArray(exec, globalObject(), list);
}
Modified: branches/chromium/874/Source/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp (95807 => 95808)
--- branches/chromium/874/Source/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp 2011-09-23 15:57:13 UTC (rev 95807)
+++ branches/chromium/874/Source/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp 2011-09-23 16:09:36 UTC (rev 95808)
@@ -260,7 +260,7 @@
return notHandledByInterceptor();
}
WebGLProgram* program = V8WebGLProgram::HasInstance(args[0]) ? V8WebGLProgram::toNative(v8::Handle<v8::Object>::Cast(args[0])) : 0;
- Vector<WebGLShader*> shaders;
+ Vector<RefPtr<WebGLShader> > shaders;
bool succeed = context->getAttachedShaders(program, shaders, ec);
if (ec) {
V8Proxy::setDOMException(ec);
@@ -270,7 +270,7 @@
return v8::Null();
v8::Local<v8::Array> array = v8::Array::New(shaders.size());
for (size_t ii = 0; ii < shaders.size(); ++ii)
- array->Set(v8::Integer::New(ii), toV8(shaders[ii]));
+ array->Set(v8::Integer::New(ii), toV8(shaders[ii].get()));
return array;
}
Modified: branches/chromium/874/Source/WebCore/html/canvas/WebGLRenderingContext.cpp (95807 => 95808)
--- branches/chromium/874/Source/WebCore/html/canvas/WebGLRenderingContext.cpp 2011-09-23 15:57:13 UTC (rev 95807)
+++ branches/chromium/874/Source/WebCore/html/canvas/WebGLRenderingContext.cpp 2011-09-23 16:09:36 UTC (rev 95808)
@@ -1900,7 +1900,7 @@
return WebGLActiveInfo::create(info.name, info.type, info.size);
}
-bool WebGLRenderingContext::getAttachedShaders(WebGLProgram* program, Vector<WebGLShader*>& shaderObjects, ExceptionCode& ec)
+bool WebGLRenderingContext::getAttachedShaders(WebGLProgram* program, Vector<RefPtr<WebGLShader> >& shaderObjects, ExceptionCode& ec)
{
UNUSED_PARAM(ec);
shaderObjects.clear();
Modified: branches/chromium/874/Source/WebCore/html/canvas/WebGLRenderingContext.h (95807 => 95808)
--- branches/chromium/874/Source/WebCore/html/canvas/WebGLRenderingContext.h 2011-09-23 15:57:13 UTC (rev 95807)
+++ branches/chromium/874/Source/WebCore/html/canvas/WebGLRenderingContext.h 2011-09-23 16:09:36 UTC (rev 95808)
@@ -143,7 +143,7 @@
PassRefPtr<WebGLActiveInfo> getActiveAttrib(WebGLProgram*, GC3Duint index, ExceptionCode&);
PassRefPtr<WebGLActiveInfo> getActiveUniform(WebGLProgram*, GC3Duint index, ExceptionCode&);
- bool getAttachedShaders(WebGLProgram*, Vector<WebGLShader*>&, ExceptionCode&);
+ bool getAttachedShaders(WebGLProgram*, Vector<RefPtr<WebGLShader> >&, ExceptionCode&);
GC3Dint getAttribLocation(WebGLProgram*, const String& name);
WebGLGetInfo getBufferParameter(GC3Denum target, GC3Denum pname, ExceptionCode&);
PassRefPtr<WebGLContextAttributes> getContextAttributes();
