Title: [211106] branches/safari-603-branch
- Revision
- 211106
- Author
- [email protected]
- Date
- 2017-01-24 13:22:59 -0800 (Tue, 24 Jan 2017)
Log Message
Merge r211065. rdar://problem/29784295
Modified Paths
Added Paths
Diff
Modified: branches/safari-603-branch/LayoutTests/ChangeLog (211105 => 211106)
--- branches/safari-603-branch/LayoutTests/ChangeLog 2017-01-24 21:22:56 UTC (rev 211105)
+++ branches/safari-603-branch/LayoutTests/ChangeLog 2017-01-24 21:22:59 UTC (rev 211106)
@@ -1,5 +1,21 @@
2017-01-24 Matthew Hanson <[email protected]>
+ Merge r211065. rdar://problem/29784295
+
+ 2017-01-23 Filip Pizlo <[email protected]>
+
+ SharedArrayBuffer plus WebGL should not equal CRASH
+ https://bugs.webkit.org/show_bug.cgi?id=167329
+
+ Reviewed by Saam Barati.
+
+ This test used to crash and now it doesn't. It throws some exception.
+
+ * js/shared-array-buffer-webgl-expected.txt: Added.
+ * js/shared-array-buffer-webgl.html: Added.
+
+2017-01-24 Matthew Hanson <[email protected]>
+
Merge r211007. rdar://problem/28620919
2017-01-20 Brady Eidson <[email protected]>
Added: branches/safari-603-branch/LayoutTests/js/shared-array-buffer-webgl-expected.txt (0 => 211106)
--- branches/safari-603-branch/LayoutTests/js/shared-array-buffer-webgl-expected.txt (rev 0)
+++ branches/safari-603-branch/LayoutTests/js/shared-array-buffer-webgl-expected.txt 2017-01-24 21:22:59 UTC (rev 211106)
@@ -0,0 +1,9 @@
+Test that passing a SharedArrayBuffer to WebGL does not crash.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: branches/safari-603-branch/LayoutTests/js/shared-array-buffer-webgl.html (0 => 211106)
--- branches/safari-603-branch/LayoutTests/js/shared-array-buffer-webgl.html (rev 0)
+++ branches/safari-603-branch/LayoutTests/js/shared-array-buffer-webgl.html 2017-01-24 21:22:59 UTC (rev 211106)
@@ -0,0 +1,32 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<canvas id="canvas"></canvas>
+<script>
+description('Test that passing a SharedArrayBuffer to WebGL does not crash.')
+
+var canvas = document.getElementById("canvas");
+var gl = canvas.getContext("webgl");
+var texture = gl.createTexture();
+
+var ext = (
+ gl.getExtension("WEBGL_compressed_texture_s3tc") ||
+ gl.getExtension("MOZ_WEBGL_compressed_texture_s3tc") ||
+ gl.getExtension("WEBKIT_WEBGL_compressed_texture_s3tc")
+);
+
+var data = "" SharedArrayBuffer(1024);
+var view = new Uint8Array(data);
+
+try {
+ var texture = gl.createTexture();
+ gl.bindTexture(gl.TEXTURE_2D, texture);
+ gl.compressedTexImage2D(gl.TEXTURE_2D, 0, ext.COMPRESSED_RGBA_S3TC_DXT5_EXT, 512, 512, 0, view);
+} catch (e) { } // This shouldn't crash.
+</script>
+<script src=""
+</body>
+</html>
Modified: branches/safari-603-branch/Source/_javascript_Core/ChangeLog (211105 => 211106)
--- branches/safari-603-branch/Source/_javascript_Core/ChangeLog 2017-01-24 21:22:56 UTC (rev 211105)
+++ branches/safari-603-branch/Source/_javascript_Core/ChangeLog 2017-01-24 21:22:59 UTC (rev 211106)
@@ -1,5 +1,23 @@
2017-01-24 Matthew Hanson <[email protected]>
+ Merge r211065. rdar://problem/29784295
+
+ 2017-01-23 Filip Pizlo <[email protected]>
+
+ SharedArrayBuffer plus WebGL should not equal CRASH
+ https://bugs.webkit.org/show_bug.cgi?id=167329
+
+ Reviewed by Saam Barati.
+
+ DOM unwrapping methods should return null rather than crashing. The code expects an
+ unshared buffer, so we should return null when it's shared. The caller can then decide
+ if they like null or not.
+
+ * runtime/JSArrayBufferViewInlines.h:
+ (JSC::JSArrayBufferView::toWrapped):
+
+2017-01-24 Matthew Hanson <[email protected]>
+
Merge r211043. rdar://problem/30134434
2017-01-23 Michael Saboff <[email protected]>
Modified: branches/safari-603-branch/Source/_javascript_Core/runtime/JSArrayBufferViewInlines.h (211105 => 211106)
--- branches/safari-603-branch/Source/_javascript_Core/runtime/JSArrayBufferViewInlines.h 2017-01-24 21:22:56 UTC (rev 211105)
+++ branches/safari-603-branch/Source/_javascript_Core/runtime/JSArrayBufferViewInlines.h 2017-01-24 21:22:59 UTC (rev 211106)
@@ -91,8 +91,10 @@
inline RefPtr<ArrayBufferView> JSArrayBufferView::toWrapped(JSValue value)
{
- if (JSArrayBufferView* view = jsDynamicCast<JSArrayBufferView*>(value))
- return view->unsharedImpl();
+ if (JSArrayBufferView* view = jsDynamicCast<JSArrayBufferView*>(value)) {
+ if (!view->isShared())
+ return view->unsharedImpl();
+ }
return nullptr;
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
