Diff
Modified: branches/safari-534.54-branch/LayoutTests/ChangeLog (104068 => 104069)
--- branches/safari-534.54-branch/LayoutTests/ChangeLog 2012-01-04 22:05:18 UTC (rev 104068)
+++ branches/safari-534.54-branch/LayoutTests/ChangeLog 2012-01-04 22:09:09 UTC (rev 104069)
@@ -1,5 +1,19 @@
2011-1-4 Lucas Forschler <[email protected]>
+ Merge 95728
+
+ 2011-09-22 Sergey Glazunov <[email protected]>
+
+ Ref protect shaders in V8WebGLRenderingContext::getAttachedShadersCallback
+ https://bugs.webkit.org/show_bug.cgi?id=68630
+
+ Reviewed by Adam Barth.
+
+ * fast/canvas/webgl/shader-deleted-by-accessor-expected.txt: Added.
+ * fast/canvas/webgl/shader-deleted-by-accessor.html: Added.
+
+2011-1-4 Lucas Forschler <[email protected]>
+
Merge 95671
2011-09-21 Abhishek Arya <[email protected]>
Copied: branches/safari-534.54-branch/LayoutTests/fast/canvas/webgl/shader-deleted-by-accessor-expected.txt (from rev 95728, trunk/LayoutTests/fast/canvas/webgl/shader-deleted-by-accessor-expected.txt) (0 => 104069)
--- branches/safari-534.54-branch/LayoutTests/fast/canvas/webgl/shader-deleted-by-accessor-expected.txt (rev 0)
+++ branches/safari-534.54-branch/LayoutTests/fast/canvas/webgl/shader-deleted-by-accessor-expected.txt 2012-01-04 22:09:09 UTC (rev 104069)
@@ -0,0 +1,8 @@
+Verifies that WebGLRenderingContext::getAttachedShaders doesn't crash when an accessor property is defined on Array.prototype.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Copied: branches/safari-534.54-branch/LayoutTests/fast/canvas/webgl/shader-deleted-by-accessor.html (from rev 95728, trunk/LayoutTests/fast/canvas/webgl/shader-deleted-by-accessor.html) (0 => 104069)
--- branches/safari-534.54-branch/LayoutTests/fast/canvas/webgl/shader-deleted-by-accessor.html (rev 0)
+++ branches/safari-534.54-branch/LayoutTests/fast/canvas/webgl/shader-deleted-by-accessor.html 2012-01-04 22:09:09 UTC (rev 104069)
@@ -0,0 +1,51 @@
+<html>
+<head>
+<link rel="stylesheet" href=""
+<script src=""
+<script src=""
+<script src=""
+</head>
+<body>
+<div id="description"></div>
+<div id="console"></div>
+
+<script>
+function gc()
+{
+ if (window.GCController)
+ return GCController.collect();
+
+ for (var i = 0; i < 10000; ++i)
+ var s = new String("AAAA");
+}
+
+description("Verifies that WebGLRenderingContext::getAttachedShaders doesn't crash when an accessor property is defined on Array.prototype.");
+
+context = create3DContext();
+program = context.createProgram();
+
+shader1 = context.createShader(context.VERTEX_SHADER);
+context.attachShader(program, shader1);
+
+for (var i = 0; i < 10; ++i) {
+ shader2 = context.createShader(context.FRAGMENT_SHADER);
+ context.attachShader(program, shader2);
+
+ Array.prototype.__defineSetter__(0, function() {
+ context.detachShader(program, shader2);
+ context.deleteShader(shader2);
+ shader2 = null;
+ gc();
+ });
+
+ shaders = context.getAttachedShaders(program);
+ context.getShaderParameter(shaders[1], 0);
+}
+
+successfullyParsed = true;
+</script>
+
+<script src=""
+</body>
+</html>
+
Modified: branches/safari-534.54-branch/Source/WebCore/ChangeLog (104068 => 104069)
--- branches/safari-534.54-branch/Source/WebCore/ChangeLog 2012-01-04 22:05:18 UTC (rev 104068)
+++ branches/safari-534.54-branch/Source/WebCore/ChangeLog 2012-01-04 22:09:09 UTC (rev 104069)
@@ -1,5 +1,26 @@
2011-1-4 Lucas Forschler <[email protected]>
+ Merge 95728
+
+ 2011-09-22 Sergey Glazunov <[email protected]>
+
+ Ref protect shaders in V8WebGLRenderingContext::getAttachedShadersCallback
+ https://bugs.webkit.org/show_bug.cgi?id=68630
+
+ Reviewed by Adam Barth.
+
+ Test: fast/canvas/webgl/shader-deleted-by-accessor.html
+
+ * bindings/js/JSWebGLRenderingContextCustom.cpp:
+ (WebCore::JSWebGLRenderingContext::getAttachedShaders):
+ * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+ (WebCore::V8WebGLRenderingContext::getAttachedShadersCallback):
+ * html/canvas/WebGLRenderingContext.cpp:
+ (WebCore::WebGLRenderingContext::getAttachedShaders):
+ * html/canvas/WebGLRenderingContext.h:
+
+2011-1-4 Lucas Forschler <[email protected]>
+
Merge 95671
2011-09-21 Abhishek Arya <[email protected]>
Modified: branches/safari-534.54-branch/Source/WebCore/bindings/js/JSWebGLRenderingContextCustom.cpp (104068 => 104069)
--- branches/safari-534.54-branch/Source/WebCore/bindings/js/JSWebGLRenderingContextCustom.cpp 2012-01-04 22:05:18 UTC (rev 104068)
+++ branches/safari-534.54-branch/Source/WebCore/bindings/js/JSWebGLRenderingContextCustom.cpp 2012-01-04 22:09:09 UTC (rev 104069)
@@ -214,7 +214,7 @@
WebGLProgram* program = toWebGLProgram(exec->argument(0));
if (exec->hadException())
return jsNull();
- Vector<WebGLShader*> shaders;
+ Vector<RefPtr<WebGLShader> > shaders;
bool succeed = context->getAttachedShaders(program, shaders, ec);
if (ec) {
setDOMException(exec, ec);
@@ -224,7 +224,7 @@
return jsNull();
MarkedArgumentBuffer list;
for (size_t ii = 0; ii < shaders.size(); ++ii)
- list.append(toJS(exec, globalObject(), shaders[ii]));
+ list.append(toJS(exec, globalObject(), shaders[ii].get()));
return constructArray(exec, globalObject(), list);
}
Modified: branches/safari-534.54-branch/Source/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp (104068 => 104069)
--- branches/safari-534.54-branch/Source/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp 2012-01-04 22:05:18 UTC (rev 104068)
+++ branches/safari-534.54-branch/Source/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp 2012-01-04 22:09:09 UTC (rev 104069)
@@ -252,7 +252,7 @@
return notHandledByInterceptor();
}
WebGLProgram* program = V8WebGLProgram::HasInstance(args[0]) ? V8WebGLProgram::toNative(v8::Handle<v8::Object>::Cast(args[0])) : 0;
- Vector<WebGLShader*> shaders;
+ Vector<RefPtr<WebGLShader> > shaders;
bool succeed = context->getAttachedShaders(program, shaders, ec);
if (ec) {
V8Proxy::setDOMException(ec);
@@ -262,7 +262,7 @@
return v8::Null();
v8::Local<v8::Array> array = v8::Array::New(shaders.size());
for (size_t ii = 0; ii < shaders.size(); ++ii)
- array->Set(v8::Integer::New(ii), toV8(shaders[ii]));
+ array->Set(v8::Integer::New(ii), toV8(shaders[ii].get()));
return array;
}
Modified: branches/safari-534.54-branch/Source/WebCore/html/canvas/WebGLRenderingContext.cpp (104068 => 104069)
--- branches/safari-534.54-branch/Source/WebCore/html/canvas/WebGLRenderingContext.cpp 2012-01-04 22:05:18 UTC (rev 104068)
+++ branches/safari-534.54-branch/Source/WebCore/html/canvas/WebGLRenderingContext.cpp 2012-01-04 22:09:09 UTC (rev 104069)
@@ -1877,7 +1877,7 @@
return WebGLActiveInfo::create(info.name, info.type, info.size);
}
-bool WebGLRenderingContext::getAttachedShaders(WebGLProgram* program, Vector<WebGLShader*>& shaderObjects, ExceptionCode& ec)
+bool WebGLRenderingContext::getAttachedShaders(WebGLProgram* program, Vector<RefPtr<WebGLShader> >& shaderObjects, ExceptionCode& ec)
{
UNUSED_PARAM(ec);
shaderObjects.clear();
Modified: branches/safari-534.54-branch/Source/WebCore/html/canvas/WebGLRenderingContext.h (104068 => 104069)
--- branches/safari-534.54-branch/Source/WebCore/html/canvas/WebGLRenderingContext.h 2012-01-04 22:05:18 UTC (rev 104068)
+++ branches/safari-534.54-branch/Source/WebCore/html/canvas/WebGLRenderingContext.h 2012-01-04 22:09:09 UTC (rev 104069)
@@ -141,7 +141,7 @@
PassRefPtr<WebGLActiveInfo> getActiveAttrib(WebGLProgram*, GC3Duint index, ExceptionCode&);
PassRefPtr<WebGLActiveInfo> getActiveUniform(WebGLProgram*, GC3Duint index, ExceptionCode&);
- bool getAttachedShaders(WebGLProgram*, Vector<WebGLShader*>&, ExceptionCode&);
+ bool getAttachedShaders(WebGLProgram*, Vector<RefPtr<WebGLShader> >&, ExceptionCode&);
GC3Dint getAttribLocation(WebGLProgram*, const String& name);
WebGLGetInfo getBufferParameter(GC3Denum target, GC3Denum pname, ExceptionCode&);
PassRefPtr<WebGLContextAttributes> getContextAttributes();
