Title: [242872] releases/WebKitGTK/webkit-2.24
- Revision
- 242872
- Author
- [email protected]
- Date
- 2019-03-13 02:25:24 -0700 (Wed, 13 Mar 2019)
Log Message
Merge r242826 - [WebGL] WebGLBuffer can be too large
https://bugs.webkit.org/show_bug.cgi?id=195068
<rdar://problem/48414289>
Reviewed by Antoine Quint.
Source/WebCore:
When creating an element array buffer, make sure to
test against the maximum size of an ArrayBuffer, rather
than just assume it can be created.
Test: fast/canvas/webgl/largeBuffer.html
* html/canvas/WebGLBuffer.cpp:
(WebCore::WebGLBuffer::associateBufferDataImpl):
LayoutTests:
* fast/canvas/webgl/largeBuffer-expected.txt: Added.
* fast/canvas/webgl/largeBuffer.html: Added.
Modified Paths
Added Paths
Diff
Modified: releases/WebKitGTK/webkit-2.24/LayoutTests/ChangeLog (242871 => 242872)
--- releases/WebKitGTK/webkit-2.24/LayoutTests/ChangeLog 2019-03-13 09:25:19 UTC (rev 242871)
+++ releases/WebKitGTK/webkit-2.24/LayoutTests/ChangeLog 2019-03-13 09:25:24 UTC (rev 242872)
@@ -1,3 +1,14 @@
+2019-03-12 Dean Jackson <[email protected]>
+
+ [WebGL] WebGLBuffer can be too large
+ https://bugs.webkit.org/show_bug.cgi?id=195068
+ <rdar://problem/48414289>
+
+ Reviewed by Antoine Quint.
+
+ * fast/canvas/webgl/largeBuffer-expected.txt: Added.
+ * fast/canvas/webgl/largeBuffer.html: Added.
+
2019-03-05 Said Abou-Hallawa <[email protected]>
SVGPathSegList.insertItemBefore() should fail if the newItem belongs to an animating animPathSegList
Added: releases/WebKitGTK/webkit-2.24/LayoutTests/fast/canvas/webgl/largeBuffer-expected.txt (0 => 242872)
--- releases/WebKitGTK/webkit-2.24/LayoutTests/fast/canvas/webgl/largeBuffer-expected.txt (rev 0)
+++ releases/WebKitGTK/webkit-2.24/LayoutTests/fast/canvas/webgl/largeBuffer-expected.txt 2019-03-13 09:25:24 UTC (rev 242872)
@@ -0,0 +1,7 @@
+CONSOLE MESSAGE: line 12: WebGL: INVALID_VALUE: bufferData: invalid buffer
+CONSOLE MESSAGE: line 15: WebGL: INVALID_VALUE: bufferSubData: offset out of range
+PASS size is 0
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: releases/WebKitGTK/webkit-2.24/LayoutTests/fast/canvas/webgl/largeBuffer.html (0 => 242872)
--- releases/WebKitGTK/webkit-2.24/LayoutTests/fast/canvas/webgl/largeBuffer.html (rev 0)
+++ releases/WebKitGTK/webkit-2.24/LayoutTests/fast/canvas/webgl/largeBuffer.html 2019-03-13 09:25:24 UTC (rev 242872)
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<script src=""
+<body>
+<canvas></canvas>
+<script>
+const canvas = document.querySelector("canvas");
+const gl = canvas.getContext("webgl");
+
+const b = gl.createBuffer();
+gl.bindBuffer(gl.ELEMENT_ARRAY_BUFFER, b);
+gl.bufferData(gl.ELEMENT_ARRAY_BUFFER, 0xf000000000, gl.STREAM_DRAW);
+const size = gl.getBufferParameter(gl.ELEMENT_ARRAY_BUFFER, gl.BUFFER_SIZE);
+shouldBeEqualToNumber("size", 0);
+gl.bufferSubData(gl.ELEMENT_ARRAY_BUFFER, 0x4444444444, new ArrayBuffer(32));
+</script>
+</body>
+</html>
+
Modified: releases/WebKitGTK/webkit-2.24/Source/WebCore/ChangeLog (242871 => 242872)
--- releases/WebKitGTK/webkit-2.24/Source/WebCore/ChangeLog 2019-03-13 09:25:19 UTC (rev 242871)
+++ releases/WebKitGTK/webkit-2.24/Source/WebCore/ChangeLog 2019-03-13 09:25:24 UTC (rev 242872)
@@ -1,3 +1,20 @@
+2019-03-12 Dean Jackson <[email protected]>
+
+ [WebGL] WebGLBuffer can be too large
+ https://bugs.webkit.org/show_bug.cgi?id=195068
+ <rdar://problem/48414289>
+
+ Reviewed by Antoine Quint.
+
+ When creating an element array buffer, make sure to
+ test against the maximum size of an ArrayBuffer, rather
+ than just assume it can be created.
+
+ Test: fast/canvas/webgl/largeBuffer.html
+
+ * html/canvas/WebGLBuffer.cpp:
+ (WebCore::WebGLBuffer::associateBufferDataImpl):
+
2019-03-05 Said Abou-Hallawa <[email protected]>
SVGPathSegList.insertItemBefore() should fail if the newItem belongs to an animating animPathSegList
Modified: releases/WebKitGTK/webkit-2.24/Source/WebCore/html/canvas/WebGLBuffer.cpp (242871 => 242872)
--- releases/WebKitGTK/webkit-2.24/Source/WebCore/html/canvas/WebGLBuffer.cpp 2019-03-13 09:25:19 UTC (rev 242871)
+++ releases/WebKitGTK/webkit-2.24/Source/WebCore/html/canvas/WebGLBuffer.cpp 2019-03-13 09:25:24 UTC (rev 242872)
@@ -62,6 +62,8 @@
switch (m_target) {
case GraphicsContext3D::ELEMENT_ARRAY_BUFFER:
+ if (byteLength > std::numeric_limits<unsigned>::max())
+ return false;
m_byteLength = byteLength;
clearCachedMaxIndices();
if (byteLength) {
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
