Title: [226908] trunk
Revision
226908
Author
[email protected]
Date
2018-01-12 13:01:02 -0800 (Fri, 12 Jan 2018)

Log Message

drawElements should be invalid if vertexAttrib0 doesn't have data
https://bugs.webkit.org/show_bug.cgi?id=181609
<rdar://problem/36392883>

Reviewed by Antoine Quint.

Source/WebCore:

If a vertex attribute has been enabled, but no data provided, then
draw validation should fail.

Test: fast/canvas/webgl/drawElements-empty-vertex-data.html

* html/canvas/WebGLRenderingContextBase.cpp:
(WebCore::WebGLRenderingContextBase::validateVertexAttributes): If there were
never any data in the vertex buffer, then we incorrectly compared with 0.

LayoutTests:

* fast/canvas/webgl/drawElements-empty-vertex-data-expected.txt: Added.
* fast/canvas/webgl/drawElements-empty-vertex-data.html: Added.

Modified Paths

Added Paths

Diff

Modified: trunk/LayoutTests/ChangeLog (226907 => 226908)


--- trunk/LayoutTests/ChangeLog	2018-01-12 20:47:44 UTC (rev 226907)
+++ trunk/LayoutTests/ChangeLog	2018-01-12 21:01:02 UTC (rev 226908)
@@ -1,3 +1,14 @@
+2018-01-12  Dean Jackson  <[email protected]>
+
+        drawElements should be invalid if vertexAttrib0 doesn't have data
+        https://bugs.webkit.org/show_bug.cgi?id=181609
+        <rdar://problem/36392883>
+
+        Reviewed by Antoine Quint.
+
+        * fast/canvas/webgl/drawElements-empty-vertex-data-expected.txt: Added.
+        * fast/canvas/webgl/drawElements-empty-vertex-data.html: Added.
+
 2018-01-12  Youenn Fablet  <[email protected]>
 
         FormDataElement::lengthInBytes should use ThreadableBlobRegistry

Added: trunk/LayoutTests/fast/canvas/webgl/drawElements-empty-vertex-data-expected.txt (0 => 226908)


--- trunk/LayoutTests/fast/canvas/webgl/drawElements-empty-vertex-data-expected.txt	                        (rev 0)
+++ trunk/LayoutTests/fast/canvas/webgl/drawElements-empty-vertex-data-expected.txt	2018-01-12 21:01:02 UTC (rev 226908)
@@ -0,0 +1,2 @@
+CONSOLE MESSAGE: line 27: WebGL: INVALID_OPERATION: drawElements: attempt to access out of bounds arrays
+PASS: Unable to draw with invalid vertexAttribArray0
Property changes on: trunk/LayoutTests/fast/canvas/webgl/drawElements-empty-vertex-data-expected.txt
___________________________________________________________________

Added: svn:eol-style

+native \ No newline at end of property

Added: svn:keywords

+Date Revision \ No newline at end of property

Added: svn:mime-type

+text/plain \ No newline at end of property

Added: trunk/LayoutTests/fast/canvas/webgl/drawElements-empty-vertex-data.html (0 => 226908)


--- trunk/LayoutTests/fast/canvas/webgl/drawElements-empty-vertex-data.html	                        (rev 0)
+++ trunk/LayoutTests/fast/canvas/webgl/drawElements-empty-vertex-data.html	2018-01-12 21:01:02 UTC (rev 226908)
@@ -0,0 +1,32 @@
+<canvas></canvas>
+<div></div>
+<script>
+if (window.testRunner)
+    testRunner.dumpAsText();
+
+let gl = document.querySelector("canvas").getContext("webgl");
+
+let shader1 = gl.createShader(gl.VERTEX_SHADER);
+gl.shaderSource(shader1, "attribute vec2 pos; void main() { gl_Position = vec4(pos, 0, 1); }");
+gl.compileShader(shader1);
+
+let shader2 = gl.createShader(gl.FRAGMENT_SHADER);
+gl.shaderSource(shader2, "precision mediump float; void main() { gl_FragColor = vec4(0,0.8,0,1); }");
+gl.compileShader(shader2);
+
+let program = gl.createProgram();
+gl.attachShader(program, shader1);
+gl.attachShader(program, shader2);
+gl.linkProgram(program);
+gl.useProgram(program);
+
+let buffer = gl.createBuffer();
+gl.bindBuffer(gl.ELEMENT_ARRAY_BUFFER, buffer);
+gl.bufferData(gl.ELEMENT_ARRAY_BUFFER, new ArrayBuffer(1), gl.STREAM_DRAW);
+gl.enableVertexAttribArray(0);
+gl.drawElements(gl.LINE_STRIP, 1, gl.UNSIGNED_BYTE, 0);
+if (gl.getError() == gl.INVALID_OPERATION)
+    document.querySelector("div").textContent = "PASS: Unable to draw with invalid vertexAttribArray0";
+else
+    document.querySelector("div").textContent = "FAIL: Was able to draw with invalid vertexAttribArray0";
+</script>
Property changes on: trunk/LayoutTests/fast/canvas/webgl/drawElements-empty-vertex-data.html
___________________________________________________________________

Added: svn:eol-style

+native \ No newline at end of property

Added: svn:keywords

+Date Revision \ No newline at end of property

Added: svn:mime-type

+text/html \ No newline at end of property

Modified: trunk/Source/WebCore/ChangeLog (226907 => 226908)


--- trunk/Source/WebCore/ChangeLog	2018-01-12 20:47:44 UTC (rev 226907)
+++ trunk/Source/WebCore/ChangeLog	2018-01-12 21:01:02 UTC (rev 226908)
@@ -1,3 +1,20 @@
+2018-01-12  Dean Jackson  <[email protected]>
+
+        drawElements should be invalid if vertexAttrib0 doesn't have data
+        https://bugs.webkit.org/show_bug.cgi?id=181609
+        <rdar://problem/36392883>
+
+        Reviewed by Antoine Quint.
+
+        If a vertex attribute has been enabled, but no data provided, then
+        draw validation should fail.
+
+        Test: fast/canvas/webgl/drawElements-empty-vertex-data.html
+
+        * html/canvas/WebGLRenderingContextBase.cpp:
+        (WebCore::WebGLRenderingContextBase::validateVertexAttributes): If there were
+        never any data in the vertex buffer, then we incorrectly compared with 0.
+
 2018-01-12  Youenn Fablet  <[email protected]>
 
         FormDataElement::lengthInBytes should use ThreadableBlobRegistry

Modified: trunk/Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp (226907 => 226908)


--- trunk/Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp	2018-01-12 20:47:44 UTC (rev 226907)
+++ trunk/Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp	2018-01-12 21:01:02 UTC (rev 226908)
@@ -1924,6 +1924,8 @@
                 // For the last element, we will only touch the data for the
                 // element and nothing beyond it.
                 int bytesRemaining = static_cast<int>(state.bufferBinding->byteLength() - state.offset);
+                if (bytesRemaining <= 0)
+                    return false;
                 unsigned numElements = 0;
                 ASSERT(state.stride > 0);
                 if (bytesRemaining >= state.bytesPerElement)
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to