[SCM] WebKit Debian packaging branch, webkit-1.2, updated. upstream/1.1.90-6072-g9a69373

cmarrin at apple.com cmarrin at apple.com
Wed Apr 7 23:54:43 UTC 2010


The following commit has been merged in the webkit-1.2 branch:
commit 31e95dba919844f535ee24b6dd2a592443962c01
Author: cmarrin at apple.com <cmarrin at apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Tue Nov 24 00:33:45 2009 +0000

            Add range checks to rendering calls in WebGL
            https://bugs.webkit.org/show_bug.cgi?id=31239
    
            I am now tracking the size of the data in each CanvasBuffer object
            and keeping track of the buffer size of each active vertex attrib.
            In drawArrays and drawElements I make sure no attempt is made to
            access elements outside the valid buffer ranges. The test at:
    
                http://cs.helsinki.fi/u/ilmarihe/c3d/functions/drawArraysOutOfBounds.html
    
            no longer crashes.
    
            I also added all the WebGL enumerations to GraphicsContext3D to use them in the validation checks
    
    
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@51327 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 825ef50..0786216 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,15 @@
+2009-11-23  Chris Marrin  <cmarrin at apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Tests for out of bounds conditions on drawElements and drawArrays
+        https://bugs.webkit.org/show_bug.cgi?id=31239
+
+        * fast/canvas/webgl/drawArraysOutOfBounds-expected.txt: Added.
+        * fast/canvas/webgl/drawArraysOutOfBounds.html: Added.
+        * fast/canvas/webgl/drawElementssOutOfBounds-expected.txt: Added.
+        * fast/canvas/webgl/drawElementssOutOfBounds.html: Added.
+
 2009-11-23  Erik Arvidsson  <arv at chromium.org>
 
         Reviewed by Eric Seidel.
diff --git a/LayoutTests/fast/canvas/webgl/drawArraysOutOfBounds-expected.txt b/LayoutTests/fast/canvas/webgl/drawArraysOutOfBounds-expected.txt
new file mode 100644
index 0000000..ec4f2e5
--- /dev/null
+++ b/LayoutTests/fast/canvas/webgl/drawArraysOutOfBounds-expected.txt
@@ -0,0 +1,28 @@
+Test of drawArrays with out-of-bounds parameters
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+Test empty buffer
+PASS context.drawArrays(context.TRIANGLES, 0, 1) threw exception Error: INVALID_STATE_ERR: DOM Exception 11.
+PASS context.drawArrays(context.TRIANGLES, 0, 10000) threw exception Error: INVALID_STATE_ERR: DOM Exception 11.
+PASS context.drawArrays(context.TRIANGLES, 0, 10000000000000) threw exception Error: INVALID_STATE_ERR: DOM Exception 11.
+PASS context.drawArrays(context.TRIANGLES, 0, -1) threw exception Error: INVALID_STATE_ERR: DOM Exception 11.
+PASS context.drawArrays(context.TRIANGLES, 1, 0) threw exception Error: INVALID_STATE_ERR: DOM Exception 11.
+PASS context.drawArrays(context.TRIANGLES, -1, 0) threw exception Error: INVALID_STATE_ERR: DOM Exception 11.
+PASS context.drawArrays(context.TRIANGLES, 1, -1) threw exception Error: INVALID_STATE_ERR: DOM Exception 11.
+PASS context.drawArrays(context.TRIANGLES, -1, 1) threw exception Error: INVALID_STATE_ERR: DOM Exception 11.
+
+Test buffer with 3 float vectors
+PASS context.drawArrays(context.TRIANGLES, 0, 3) is undefined
+PASS context.drawArrays(context.TRIANGLES, 3, 2) threw exception Error: INVALID_STATE_ERR: DOM Exception 11.
+PASS context.drawArrays(context.TRIANGLES, 0, 10000) threw exception Error: INVALID_STATE_ERR: DOM Exception 11.
+PASS context.drawArrays(context.TRIANGLES, 0, 10000000000000) threw exception Error: INVALID_STATE_ERR: DOM Exception 11.
+PASS context.drawArrays(context.TRIANGLES, 0, -1) threw exception Error: INVALID_STATE_ERR: DOM Exception 11.
+PASS context.drawArrays(context.TRIANGLES, -1, 0) threw exception Error: INVALID_STATE_ERR: DOM Exception 11.
+PASS context.drawArrays(context.TRIANGLES, 1, -1) threw exception Error: INVALID_STATE_ERR: DOM Exception 11.
+PASS context.drawArrays(context.TRIANGLES, -1, 1) threw exception Error: INVALID_STATE_ERR: DOM Exception 11.
+
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/fast/canvas/webgl/drawArraysOutOfBounds.html b/LayoutTests/fast/canvas/webgl/drawArraysOutOfBounds.html
new file mode 100644
index 0000000..63992bf
--- /dev/null
+++ b/LayoutTests/fast/canvas/webgl/drawArraysOutOfBounds.html
@@ -0,0 +1,53 @@
+<html>
+<head>
+<link rel="stylesheet" href="../../js/resources/js-test-style.css"/>
+<script src="../../js/resources/js-test-pre.js"></script>
+<script src="resources/webgl-test.js"></script>
+</head>
+<body>
+<div id="description"></div>
+<div id="console"></div>
+
+<script>
+description("Test of drawArrays with out-of-bounds parameters");
+
+var context = create3DContext();
+var program = loadStandardProgram(context);
+
+context.useProgram(program);
+var vertexObject = context.createBuffer();
+context.bindBuffer(context.ARRAY_BUFFER, vertexObject);
+context.enableVertexAttribArray(0);
+
+debug("Test empty buffer")
+context.bufferData(context.ARRAY_BUFFER, new WebGLFloatArray([  ]), context.STATIC_DRAW);
+context.vertexAttribPointer(0, 3, context.FLOAT, false, 0, 0);
+shouldThrow("context.drawArrays(context.TRIANGLES, 0, 1)");
+shouldThrow("context.drawArrays(context.TRIANGLES, 0, 10000)");
+shouldThrow("context.drawArrays(context.TRIANGLES, 0, 10000000000000)");
+shouldThrow("context.drawArrays(context.TRIANGLES, 0, -1)");
+shouldThrow("context.drawArrays(context.TRIANGLES, 1, 0)");
+shouldThrow("context.drawArrays(context.TRIANGLES, -1, 0)");
+shouldThrow("context.drawArrays(context.TRIANGLES, 1, -1)");
+shouldThrow("context.drawArrays(context.TRIANGLES, -1, 1)");
+
+debug("")
+debug("Test buffer with 3 float vectors")
+context.bufferData(context.ARRAY_BUFFER, new WebGLFloatArray([ 0,0.5,0, -0.5,-0.5,0, 0.5,-0.5,0 ]), context.STATIC_DRAW);
+context.vertexAttribPointer(0, 3, context.FLOAT, false, 0, 0);
+shouldBe("context.drawArrays(context.TRIANGLES, 0, 3)", "undefined");
+shouldThrow("context.drawArrays(context.TRIANGLES, 3, 2)");
+shouldThrow("context.drawArrays(context.TRIANGLES, 0, 10000)");
+shouldThrow("context.drawArrays(context.TRIANGLES, 0, 10000000000000)");
+shouldThrow("context.drawArrays(context.TRIANGLES, 0, -1)");
+shouldThrow("context.drawArrays(context.TRIANGLES, -1, 0)");
+shouldThrow("context.drawArrays(context.TRIANGLES, 1, -1)");
+shouldThrow("context.drawArrays(context.TRIANGLES, -1, 1)");
+
+debug("")
+successfullyParsed = true;
+</script>
+
+<script src="../../js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/LayoutTests/fast/canvas/webgl/drawElementssOutOfBounds-expected.txt b/LayoutTests/fast/canvas/webgl/drawElementssOutOfBounds-expected.txt
new file mode 100644
index 0000000..ec85a45
--- /dev/null
+++ b/LayoutTests/fast/canvas/webgl/drawElementssOutOfBounds-expected.txt
@@ -0,0 +1,26 @@
+Test of drawElements with out-of-bounds parameters
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+Test empty index buffer
+PASS context.drawElements(context.TRIANGLES, 3, context.UNSIGNED_BYTE, 0) threw exception Error: INVALID_STATE_ERR: DOM Exception 11.
+PASS context.drawElements(context.TRIANGLES, 10000, context.UNSIGNED_BYTE, 0) threw exception Error: INVALID_STATE_ERR: DOM Exception 11.
+PASS context.drawElements(context.TRIANGLES, 10000000000000, context.UNSIGNED_BYTE, 0) threw exception Error: INVALID_STATE_ERR: DOM Exception 11.
+PASS context.drawElements(context.TRIANGLES, 1, context.UNSIGNED_BYTE, 0) threw exception Error: INVALID_STATE_ERR: DOM Exception 11.
+PASS context.drawElements(context.TRIANGLES, 0, context.UNSIGNED_BYTE, -1) threw exception Error: INVALID_STATE_ERR: DOM Exception 11.
+PASS context.drawElements(context.TRIANGLES, -1, context.UNSIGNED_BYTE, 1) threw exception Error: INVALID_STATE_ERR: DOM Exception 11.
+PASS context.drawElements(context.TRIANGLES, 1, context.UNSIGNED_BYTE, -1) threw exception Error: INVALID_STATE_ERR: DOM Exception 11.
+
+Test buffer with 3 byte indexes
+PASS context.drawElements(context.TRIANGLES, 3, context.UNSIGNED_BYTE, 0) is undefined
+PASS context.drawElements(context.TRIANGLES, 3, context.UNSIGNED_BYTE, 2) threw exception Error: INVALID_STATE_ERR: DOM Exception 11.
+PASS context.drawElements(context.TRIANGLES, 10000, context.UNSIGNED_BYTE, 0) threw exception Error: INVALID_STATE_ERR: DOM Exception 11.
+PASS context.drawElements(context.TRIANGLES, 10000000000000, context.UNSIGNED_BYTE, 0) threw exception Error: INVALID_STATE_ERR: DOM Exception 11.
+PASS context.drawElements(context.TRIANGLES, 0, context.UNSIGNED_BYTE, -1) threw exception Error: INVALID_STATE_ERR: DOM Exception 11.
+PASS context.drawElements(context.TRIANGLES, -1, context.UNSIGNED_BYTE, 1) threw exception Error: INVALID_STATE_ERR: DOM Exception 11.
+PASS context.drawElements(context.TRIANGLES, 1, context.UNSIGNED_BYTE, -1) threw exception Error: INVALID_STATE_ERR: DOM Exception 11.
+
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/fast/canvas/webgl/drawElementssOutOfBounds.html b/LayoutTests/fast/canvas/webgl/drawElementssOutOfBounds.html
new file mode 100644
index 0000000..29a02f4
--- /dev/null
+++ b/LayoutTests/fast/canvas/webgl/drawElementssOutOfBounds.html
@@ -0,0 +1,55 @@
+<html>
+<head>
+<link rel="stylesheet" href="../../js/resources/js-test-style.css"/>
+<script src="../../js/resources/js-test-pre.js"></script>
+<script src="resources/webgl-test.js"></script>
+</head>
+<body>
+<div id="description"></div>
+<div id="console"></div>
+
+<script>
+description("Test of drawElements with out-of-bounds parameters");
+
+var context = create3DContext();
+var program = loadStandardProgram(context);
+
+context.useProgram(program);
+var vertexObject = context.createBuffer();
+context.enableVertexAttribArray(0);
+context.bindBuffer(context.ARRAY_BUFFER, vertexObject);
+context.bufferData(context.ARRAY_BUFFER, new WebGLFloatArray([ 0,0.5,0, -0.5,-0.5,0, 0.5,-0.5,0 ]), context.STATIC_DRAW);
+context.vertexAttribPointer(0, 3, context.FLOAT, false, 0, 0);
+
+var indexObject = context.createBuffer();
+
+debug("Test empty index buffer")
+context.bindBuffer(context.ELEMENT_ARRAY_BUFFER, indexObject);
+context.bufferData(context.ELEMENT_ARRAY_BUFFER, new WebGLUnsignedByteArray([  ]), context.STATIC_DRAW);
+shouldThrow("context.drawElements(context.TRIANGLES, 3, context.UNSIGNED_BYTE, 0)");
+shouldThrow("context.drawElements(context.TRIANGLES, 10000, context.UNSIGNED_BYTE, 0)");
+shouldThrow("context.drawElements(context.TRIANGLES, 10000000000000, context.UNSIGNED_BYTE, 0)");
+shouldThrow("context.drawElements(context.TRIANGLES, 1, context.UNSIGNED_BYTE, 0)");
+shouldThrow("context.drawElements(context.TRIANGLES, 0, context.UNSIGNED_BYTE, -1)");
+shouldThrow("context.drawElements(context.TRIANGLES, -1, context.UNSIGNED_BYTE, 1)");
+shouldThrow("context.drawElements(context.TRIANGLES, 1, context.UNSIGNED_BYTE, -1)");
+
+debug("")
+debug("Test buffer with 3 byte indexes")
+context.bindBuffer(context.ELEMENT_ARRAY_BUFFER, indexObject);
+context.bufferData(context.ELEMENT_ARRAY_BUFFER, new WebGLUnsignedByteArray([ 0, 1, 2 ]), context.STATIC_DRAW);
+shouldBe("context.drawElements(context.TRIANGLES, 3, context.UNSIGNED_BYTE, 0)", "undefined");
+shouldThrow("context.drawElements(context.TRIANGLES, 3, context.UNSIGNED_BYTE, 2)");
+shouldThrow("context.drawElements(context.TRIANGLES, 10000, context.UNSIGNED_BYTE, 0)");
+shouldThrow("context.drawElements(context.TRIANGLES, 10000000000000, context.UNSIGNED_BYTE, 0)");
+shouldThrow("context.drawElements(context.TRIANGLES, 0, context.UNSIGNED_BYTE, -1)");
+shouldThrow("context.drawElements(context.TRIANGLES, -1, context.UNSIGNED_BYTE, 1)");
+shouldThrow("context.drawElements(context.TRIANGLES, 1, context.UNSIGNED_BYTE, -1)");
+
+debug("")
+successfullyParsed = true;
+</script>
+
+<script src="../../js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index d7f363d..0440ffb 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,75 @@
+2009-11-23  Chris Marrin  <cmarrin at apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Add range checks to rendering calls in WebGL
+        https://bugs.webkit.org/show_bug.cgi?id=31239
+
+        I am now tracking the size of the data in each CanvasBuffer object
+        and keeping track of the buffer size of each active vertex attrib.
+        In drawArrays and drawElements I make sure no attempt is made to
+        access elements outside the valid buffer ranges. The test at:
+
+            http://cs.helsinki.fi/u/ilmarihe/c3d/functions/drawArraysOutOfBounds.html
+
+        no longer crashes.
+
+        I also added all the WebGL enumerations to GraphicsContext3D to use them in the validation checks
+
+        Tests: fast/canvas/webgl/drawArraysOutOfBounds.html
+               fast/canvas/webgl/drawElementssOutOfBounds.html
+
+        * bindings/js/JSWebGLArrayCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSWebGLRenderingContextCustom.cpp:
+        (WebCore::JSWebGLRenderingContext::bufferData):
+        (WebCore::JSWebGLRenderingContext::bufferSubData):
+        (WebCore::JSWebGLRenderingContext::texSubImage2D):
+        * html/canvas/WebGLArrayBuffer.cpp:
+        (WebCore::WebGLArrayBuffer::create):
+        (WebCore::WebGLArrayBuffer::data):
+        * html/canvas/WebGLArrayBuffer.h:
+        * html/canvas/WebGLBuffer.cpp:
+        (WebCore::WebGLBuffer::WebGLBuffer):
+        (WebCore::WebGLBuffer::associateBufferData):
+        (WebCore::WebGLBuffer::associateBufferSubData):
+        (WebCore::WebGLBuffer::byteLength):
+        * html/canvas/WebGLBuffer.h:
+        (WebCore::WebGLBuffer::elementArrayBuffer):
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::WebGLRenderingContext):
+        (WebCore::WebGLRenderingContext::sizeInBytes):
+        (WebCore::WebGLRenderingContext::bindBuffer):
+        (WebCore::WebGLRenderingContext::bufferData):
+        (WebCore::WebGLRenderingContext::bufferSubData):
+        (WebCore::WebGLRenderingContext::createShader):
+        (WebCore::WebGLRenderingContext::disableVertexAttribArray):
+        (WebCore::WebGLRenderingContext::validateIndexArray):
+        (WebCore::WebGLRenderingContext::validateRenderingState):
+        (WebCore::WebGLRenderingContext::drawArrays):
+        (WebCore::WebGLRenderingContext::drawElements):
+        (WebCore::WebGLRenderingContext::enableVertexAttribArray):
+        (WebCore::WebGLRenderingContext::isFramebuffer):
+        (WebCore::WebGLRenderingContext::isProgram):
+        (WebCore::WebGLRenderingContext::isRenderbuffer):
+        (WebCore::WebGLRenderingContext::isShader):
+        (WebCore::WebGLRenderingContext::isTexture):
+        (WebCore::WebGLRenderingContext::useProgram):
+        (WebCore::WebGLRenderingContext::validateProgram):
+        (WebCore::WebGLRenderingContext::vertexAttribPointer):
+        (WebCore::WebGLRenderingContext::detachAndRemoveAllObjects):
+        * html/canvas/WebGLRenderingContext.h:
+        (WebCore::WebGLRenderingContext::VertexAttribState::VertexAttribState):
+        * html/canvas/WebGLRenderingContext.idl:
+        * html/canvas/WebGLShader.cpp:
+        (WebCore::WebGLShader::create):
+        (WebCore::WebGLShader::WebGLShader):
+        * html/canvas/WebGLShader.h:
+        * platform/graphics/GraphicsContext3D.h:
+        (WebCore::GraphicsContext3D::):
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::createShader):
+
 2009-11-23  Erik Arvidsson  <arv at chromium.org>
 
         Reviewed by Eric Seidel.
diff --git a/WebCore/bindings/js/JSWebGLArrayCustom.cpp b/WebCore/bindings/js/JSWebGLArrayCustom.cpp
index 4348054..9018544 100644
--- a/WebCore/bindings/js/JSWebGLArrayCustom.cpp
+++ b/WebCore/bindings/js/JSWebGLArrayCustom.cpp
@@ -45,6 +45,9 @@ namespace WebCore {
 
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WebGLArray* object)
 {
+    if (!object)
+        return jsUndefined();
+        
     if (object) {
         if (object->isFloatArray())
             return getDOMObjectWrapper<JSWebGLFloatArray>(exec, globalObject, static_cast<WebGLFloatArray*>(object));
diff --git a/WebCore/bindings/js/JSWebGLRenderingContextCustom.cpp b/WebCore/bindings/js/JSWebGLRenderingContextCustom.cpp
index d3d27c2..d89eca7 100644
--- a/WebCore/bindings/js/JSWebGLRenderingContextCustom.cpp
+++ b/WebCore/bindings/js/JSWebGLRenderingContextCustom.cpp
@@ -53,17 +53,19 @@ JSValue JSWebGLRenderingContext::bufferData(JSC::ExecState* exec, JSC::ArgList c
 
     unsigned target = args.at(0).toInt32(exec);
     unsigned usage = args.at(2).toInt32(exec);
+    ExceptionCode ec = 0;
 
     // If argument 1 is a number, we are initializing this buffer to that size
     if (!args.at(1).isObject()) {
         unsigned int count = args.at(1).toInt32(exec);
-        static_cast<WebGLRenderingContext*>(impl())->bufferData(target, count, usage);
-        return jsUndefined();
+        static_cast<WebGLRenderingContext*>(impl())->bufferData(target, count, usage, ec);
+    } else {
+        WebGLArray* array = toWebGLArray(args.at(1));
+        static_cast<WebGLRenderingContext*>(impl())->bufferData(target, array, usage, ec);
     }
 
-    WebGLArray* array = toWebGLArray(args.at(1));
-    
-    static_cast<WebGLRenderingContext*>(impl())->bufferData(target, array, usage);
+    if (ec != 0)
+        setDOMException(exec, ec);
     return jsUndefined();
 }
 
@@ -74,10 +76,14 @@ JSValue JSWebGLRenderingContext::bufferSubData(JSC::ExecState* exec, JSC::ArgLis
 
     unsigned target = args.at(0).toInt32(exec);
     unsigned offset = args.at(1).toInt32(exec);
+    ExceptionCode ec = 0;
     
     WebGLArray* array = toWebGLArray(args.at(2));
     
-    static_cast<WebGLRenderingContext*>(impl())->bufferSubData(target, offset, array);
+    static_cast<WebGLRenderingContext*>(impl())->bufferSubData(target, offset, array, ec);
+
+    if (ec != 0)
+        setDOMException(exec, ec);
     return jsUndefined();
 }
 
@@ -192,10 +198,11 @@ JSValue JSWebGLRenderingContext::texSubImage2D(ExecState* exec, const ArgList& a
     } else if (o->inherits(&JSHTMLCanvasElement::s_info)) {
         HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(static_cast<JSHTMLElement*>(o)->impl());
         context->texSubImage2D(target, level, xoff, yoff, width, height, canvas, flipY, premultiplyAlpha, ec);
-    } else {
-        setDOMException(exec, TYPE_MISMATCH_ERR);
-    }
+    } else
+        ec = TYPE_MISMATCH_ERR;
     
+    if (ec != 0)
+        setDOMException(exec, ec);
     return jsUndefined();    
 }
 
diff --git a/WebCore/html/canvas/WebGLArrayBuffer.cpp b/WebCore/html/canvas/WebGLArrayBuffer.cpp
index 8a7da01..c565691 100644
--- a/WebCore/html/canvas/WebGLArrayBuffer.cpp
+++ b/WebCore/html/canvas/WebGLArrayBuffer.cpp
@@ -29,6 +29,8 @@
 
 #include "WebGLArrayBuffer.h"
 
+#include <wtf/RefPtr.h>
+
 namespace WebCore {
 
 PassRefPtr<WebGLArrayBuffer> WebGLArrayBuffer::create(unsigned sizeInBytes)
@@ -36,6 +38,13 @@ PassRefPtr<WebGLArrayBuffer> WebGLArrayBuffer::create(unsigned sizeInBytes)
     return adoptRef(new WebGLArrayBuffer(sizeInBytes));
 }
 
+PassRefPtr<WebGLArrayBuffer> WebGLArrayBuffer::create(WebGLArrayBuffer* other)
+{
+    RefPtr<WebGLArrayBuffer> buffer = adoptRef(new WebGLArrayBuffer(other->byteLength()));
+    memcpy(buffer->data(), other->data(), other->byteLength());
+    return buffer.release();
+}
+
 WebGLArrayBuffer::WebGLArrayBuffer(unsigned sizeInBytes) {
     m_sizeInBytes = sizeInBytes;
     m_data = WTF::fastZeroedMalloc(sizeInBytes);
@@ -45,6 +54,10 @@ void* WebGLArrayBuffer::data() {
     return m_data;
 }
 
+const void* WebGLArrayBuffer::data() const {
+    return m_data;
+}
+
 unsigned WebGLArrayBuffer::byteLength() const {
     return m_sizeInBytes;
 }
diff --git a/WebCore/html/canvas/WebGLArrayBuffer.h b/WebCore/html/canvas/WebGLArrayBuffer.h
index ffbbef1..a076e16 100644
--- a/WebCore/html/canvas/WebGLArrayBuffer.h
+++ b/WebCore/html/canvas/WebGLArrayBuffer.h
@@ -34,8 +34,10 @@ namespace WebCore {
 class WebGLArrayBuffer : public RefCounted<WebGLArrayBuffer> {
   public:
     static PassRefPtr<WebGLArrayBuffer> create(unsigned sizeInBytes);
+    static PassRefPtr<WebGLArrayBuffer> create(WebGLArrayBuffer*);
 
     void* data();
+    const void* data() const;
     unsigned byteLength() const;
 
     ~WebGLArrayBuffer();
diff --git a/WebCore/html/canvas/WebGLBuffer.cpp b/WebCore/html/canvas/WebGLBuffer.cpp
index 472d53a..45a81ba 100644
--- a/WebCore/html/canvas/WebGLBuffer.cpp
+++ b/WebCore/html/canvas/WebGLBuffer.cpp
@@ -39,6 +39,9 @@ PassRefPtr<WebGLBuffer> WebGLBuffer::create(WebGLRenderingContext* ctx)
 
 WebGLBuffer::WebGLBuffer(WebGLRenderingContext* ctx)
     : CanvasObject(ctx)
+    , m_elementArrayBufferByteLength(0)
+    , m_arrayBufferByteLength(0)
+    , m_elementArrayBufferCloned(false)
 {
     setObject(context()->graphicsContext3D()->createBuffer());
 }
@@ -48,6 +51,76 @@ void WebGLBuffer::_deleteObject(Platform3DObject object)
     context()->graphicsContext3D()->deleteBuffer(object);
 }
 
+bool WebGLBuffer::associateBufferData(unsigned long target, int size)
+{
+    if (target == GraphicsContext3D::ELEMENT_ARRAY_BUFFER) {
+        m_elementArrayBufferByteLength = size;
+        return true;
+    }
+    
+    if (target == GraphicsContext3D::ARRAY_BUFFER) {
+        m_arrayBufferByteLength = size;
+        return true;
+    }
+
+    return false;
+}
+
+bool WebGLBuffer::associateBufferData(unsigned long target, WebGLArray* array)
+{
+    if (!array)
+        return false;
+        
+    if (target == GraphicsContext3D::ELEMENT_ARRAY_BUFFER) {
+        m_elementArrayBufferByteLength = array->byteLength();
+        m_elementArrayBuffer = array->buffer();
+        m_elementArrayBufferCloned = false;
+        return true;
+    }
+    
+    if (target == GraphicsContext3D::ARRAY_BUFFER) {
+        m_arrayBufferByteLength = array->byteLength();
+        return true;
+    }
+    
+    return false;
+}
+
+bool WebGLBuffer::associateBufferSubData(unsigned long target, long offset, WebGLArray* array)
+{
+    if (!array)
+        return false;
+        
+    if (target == GraphicsContext3D::ELEMENT_ARRAY_BUFFER) {
+        // We need to protect against integer overflow with these tests
+        if (offset < 0)
+            return false;
+            
+        unsigned long uoffset = static_cast<unsigned long>(offset);
+        if (uoffset > m_elementArrayBufferByteLength || array->byteLength() > m_elementArrayBufferByteLength - uoffset)
+            return false;
+            
+        // If we already have a buffer, we need to clone it and add the new data
+        if (m_elementArrayBuffer && !m_elementArrayBufferCloned) {
+            m_elementArrayBuffer = WebGLArrayBuffer::create(m_elementArrayBuffer.get());
+            m_elementArrayBufferCloned = true;
+        }
+            
+        memcpy(static_cast<unsigned char*>(m_elementArrayBuffer->data()) + offset, array->baseAddress(), array->byteLength());
+        return true;
+    }
+    
+    if (target == GraphicsContext3D::ARRAY_BUFFER)
+        return array->byteLength() + offset <= m_arrayBufferByteLength;
+
+    return false;
+}
+
+unsigned WebGLBuffer::byteLength(unsigned long target) const
+{
+    return (target == GraphicsContext3D::ARRAY_BUFFER) ? m_arrayBufferByteLength : m_elementArrayBufferByteLength;
+}
+
 }
 
 #endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/WebGLBuffer.h b/WebCore/html/canvas/WebGLBuffer.h
index 0739f13..ed29e85 100644
--- a/WebCore/html/canvas/WebGLBuffer.h
+++ b/WebCore/html/canvas/WebGLBuffer.h
@@ -27,6 +27,7 @@
 #define WebGLBuffer_h
 
 #include "CanvasObject.h"
+#include "WebGLArrayBuffer.h"
 
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
@@ -39,10 +40,23 @@ namespace WebCore {
         
         static PassRefPtr<WebGLBuffer> create(WebGLRenderingContext*);
         
+        bool associateBufferData(unsigned long target, int size);
+        bool associateBufferData(unsigned long target, WebGLArray* array);
+        bool associateBufferSubData(unsigned long target, long offset, WebGLArray* array);
+        
+        unsigned byteLength(unsigned long target) const;
+        const WebGLArrayBuffer* elementArrayBuffer() const { return m_elementArrayBuffer.get(); }
+                        
     protected:
         WebGLBuffer(WebGLRenderingContext*);
         
         virtual void _deleteObject(Platform3DObject o);
+    
+    private:
+        RefPtr<WebGLArrayBuffer> m_elementArrayBuffer;
+        unsigned m_elementArrayBufferByteLength;
+        unsigned m_arrayBufferByteLength;
+        bool m_elementArrayBufferCloned;
     };
     
 } // namespace WebCore
diff --git a/WebCore/html/canvas/WebGLRenderingContext.cpp b/WebCore/html/canvas/WebGLRenderingContext.cpp
index aa0aa24..b35155f 100644
--- a/WebCore/html/canvas/WebGLRenderingContext.cpp
+++ b/WebCore/html/canvas/WebGLRenderingContext.cpp
@@ -60,6 +60,7 @@ WebGLRenderingContext::WebGLRenderingContext(HTMLCanvasElement* passedCanvas, Pa
     , m_markedCanvasDirty(false)
 {
     ASSERT(m_context);
+    m_maxVertexAttribs = m_context->getInteger(GraphicsContext3D::MAX_VERTEX_ATTRIBS);
     m_context->reshape(canvas()->width(), canvas()->height());
 }
 
@@ -117,9 +118,9 @@ void WebGLRenderingContext::reshape(int width, int height)
 int WebGLRenderingContext::sizeInBytes(int type, ExceptionCode& ec)
 {
     int result = m_context->sizeInBytes(type);
-    if (result <= 0) {
+    if (result <= 0)
         ec = SYNTAX_ERR;
-    }
+
     return result;
 }
 
@@ -155,6 +156,16 @@ void WebGLRenderingContext::bindBuffer(unsigned long target, WebGLBuffer* buffer
         ec = TYPE_MISMATCH_ERR;
         return;
     }
+
+    if (target == GraphicsContext3D::ARRAY_BUFFER)
+        m_boundArrayBuffer = buffer;
+    else if (target == GraphicsContext3D::ELEMENT_ARRAY_BUFFER)
+        m_boundElementArrayBuffer = buffer;
+    else {
+        ec = SYNTAX_ERR;
+        return;
+    }
+
     m_context->bindBuffer(target, buffer);
     cleanupAfterGraphicsCall(false);
 }
@@ -222,20 +233,65 @@ void WebGLRenderingContext::blendFuncSeparate(unsigned long srcRGB, unsigned lon
     cleanupAfterGraphicsCall(false);
 }
 
-void WebGLRenderingContext::bufferData(unsigned long target, int size, unsigned long usage)
+void WebGLRenderingContext::bufferData(unsigned long target, int size, unsigned long usage, ExceptionCode& ec)
 {
+    if (target == GraphicsContext3D::ELEMENT_ARRAY_BUFFER && m_boundElementArrayBuffer) {
+        if (!m_boundElementArrayBuffer->associateBufferData(target, size)) {
+            ec = SYNTAX_ERR;
+            return;
+        }
+    } else if (target == GraphicsContext3D::ARRAY_BUFFER && m_boundArrayBuffer) {
+        if (!m_boundArrayBuffer->associateBufferData(target, size)) {
+            ec = SYNTAX_ERR;
+            return;
+        }
+    } else {
+        ec = SYNTAX_ERR;
+        return;
+    }
+
     m_context->bufferData(target, size, usage);
     cleanupAfterGraphicsCall(false);
 }
 
-void WebGLRenderingContext::bufferData(unsigned long target, WebGLArray* data, unsigned long usage)
+void WebGLRenderingContext::bufferData(unsigned long target, WebGLArray* data, unsigned long usage, ExceptionCode& ec)
 {
+    if (target == GraphicsContext3D::ELEMENT_ARRAY_BUFFER && m_boundElementArrayBuffer) {
+        if (!m_boundElementArrayBuffer->associateBufferData(target, data)) {
+            ec = SYNTAX_ERR;
+            return;
+        }
+    } else if (target == GraphicsContext3D::ARRAY_BUFFER && m_boundArrayBuffer) {
+        if (!m_boundArrayBuffer->associateBufferData(target, data)) {
+            ec = SYNTAX_ERR;
+            return;
+        }
+    } else {
+        ec = SYNTAX_ERR;
+        return;
+    }
+
     m_context->bufferData(target, data, usage);
     cleanupAfterGraphicsCall(false);
 }
 
-void WebGLRenderingContext::bufferSubData(unsigned long target, long offset, WebGLArray* data)
+void WebGLRenderingContext::bufferSubData(unsigned long target, long offset, WebGLArray* data, ExceptionCode& ec)
 {
+    if (target == GraphicsContext3D::ELEMENT_ARRAY_BUFFER && m_boundElementArrayBuffer) {
+        if (!m_boundElementArrayBuffer->associateBufferSubData(target, offset, data)) {
+            ec = SYNTAX_ERR;
+            return;
+        }
+    } else if (target == GraphicsContext3D::ARRAY_BUFFER && m_boundArrayBuffer) {
+        if (!m_boundArrayBuffer->associateBufferSubData(target, offset, data)) {
+            ec = SYNTAX_ERR;
+            return;
+        }
+    } else {
+        ec = SYNTAX_ERR;
+        return;
+    }
+
     m_context->bufferSubData(target, offset, data);
     cleanupAfterGraphicsCall(false);
 }
@@ -343,13 +399,8 @@ PassRefPtr<WebGLRenderbuffer> WebGLRenderingContext::createRenderbuffer()
 
 PassRefPtr<WebGLShader> WebGLRenderingContext::createShader(unsigned long type)
 {
-    // FIXME: Need to include GL_ constants for internal use
     // FIXME: Need to do param checking and throw exception if an illegal value is passed in
-    GraphicsContext3D::ShaderType shaderType = GraphicsContext3D::VERTEX_SHADER;
-    if (type == 0x8B30) // GL_FRAGMENT_SHADER
-        shaderType = GraphicsContext3D::FRAGMENT_SHADER;
-        
-    RefPtr<WebGLShader> o = WebGLShader::create(this, shaderType);
+    RefPtr<WebGLShader> o = WebGLShader::create(this, static_cast<GraphicsContext3D::WebGLEnumType>(type));
     addObject(o.get());
     return o;
 }
@@ -443,21 +494,108 @@ void WebGLRenderingContext::disable(unsigned long cap)
     cleanupAfterGraphicsCall(false);
 }
 
-void WebGLRenderingContext::disableVertexAttribArray(unsigned long index)
+void WebGLRenderingContext::disableVertexAttribArray(unsigned long index, ExceptionCode& ec)
 {
+    if (index >= m_maxVertexAttribs) {
+        ec = INVALID_STATE_ERR;
+        return;
+    }
+    
+    if (index < m_vertexAttribState.size())
+        m_vertexAttribState[index].enabled = false;
+    
     m_context->disableVertexAttribArray(index);
     cleanupAfterGraphicsCall(false);
 }
 
+bool WebGLRenderingContext::validateIndexArray(unsigned long count, unsigned long type, long offset, long& numElements)
+{
+    long lastIndex = -1;
+    if (!m_boundElementArrayBuffer)
+        return false;
+        
+    if (offset < 0)
+        return false;
+        
+    // The GL spec says that count must be "greater
+    
+    unsigned long uoffset = static_cast<unsigned long>(offset);
+    
+    if (type == GraphicsContext3D::UNSIGNED_SHORT) {
+        // For an unsigned short array, offset must be divisible by 2 for alignment reasons
+        if (uoffset & 1 != 0)
+            return false;
+        
+        // Make uoffset an element offset
+        uoffset /= 2;
+    
+        unsigned long n = m_boundElementArrayBuffer->byteLength(GraphicsContext3D::ELEMENT_ARRAY_BUFFER) / 2;
+        if (uoffset > n || count > n - uoffset)
+            return false;
+            
+        const unsigned short* p = static_cast<const unsigned short*>(m_boundElementArrayBuffer->elementArrayBuffer()->data());
+        while (n-- > 0) {
+            if (*p > lastIndex)
+                lastIndex = *p;
+            ++p;
+        }
+    }
+    else if (type == GraphicsContext3D::UNSIGNED_BYTE) {
+        unsigned long n = m_boundElementArrayBuffer->byteLength(GraphicsContext3D::ELEMENT_ARRAY_BUFFER);
+        if (uoffset > n || count > n - uoffset)
+            return false;
+            
+        const unsigned char* p = static_cast<const unsigned char*>(m_boundElementArrayBuffer->elementArrayBuffer()->data());
+        while (n-- > 0) {
+            if (*p > lastIndex)
+                lastIndex = *p;
+            ++p;
+        }
+    }    
+        
+    // Then set the last index in the index array and make sure it is valid
+    numElements = lastIndex + 1;
+    return numElements > 0;
+}
+
+bool WebGLRenderingContext::validateRenderingState(long numElements)
+{
+    // Look in each enabled vertex attrib and find the smallest buffer size
+    long smallestNumElements = LONG_MAX;
+    for (unsigned i = 0; i < m_vertexAttribState.size(); ++i) {
+        const VertexAttribState& state = m_vertexAttribState[i];
+        if (state.enabled && state.numElements < smallestNumElements)
+            smallestNumElements = state.numElements;
+    }
+    
+    if (smallestNumElements == LONG_MAX)
+        smallestNumElements = 0;
+    
+    return numElements <= smallestNumElements;
+}
 
-void WebGLRenderingContext::drawArrays(unsigned long mode, long first, long count)
+void WebGLRenderingContext::drawArrays(unsigned long mode, long first, long count, ExceptionCode& ec)
 {
+    // Ensure we have a valid rendering state
+    if (first < 0 || count < 0 || !validateRenderingState(first + count)) {
+        ec = INVALID_STATE_ERR;
+        return;
+    }
+    
     m_context->drawArrays(mode, first, count);
     cleanupAfterGraphicsCall(true);
 }
 
-void WebGLRenderingContext::drawElements(unsigned long mode, unsigned long count, unsigned long type, long offset)
+void WebGLRenderingContext::drawElements(unsigned long mode, unsigned long count, unsigned long type, long offset, ExceptionCode& ec)
 {
+    // Ensure we have a valid rendering state
+    long numElements;
+    
+    if (offset < 0 || !validateIndexArray(count, type, offset, numElements) || !validateRenderingState(numElements)) {
+        ec = INVALID_STATE_ERR;
+        return;
+    }
+    
     m_context->drawElements(mode, count, type, offset);
     cleanupAfterGraphicsCall(true);
 }
@@ -468,8 +606,18 @@ void WebGLRenderingContext::enable(unsigned long cap)
     cleanupAfterGraphicsCall(false);
 }
 
-void WebGLRenderingContext::enableVertexAttribArray(unsigned long index)
+void WebGLRenderingContext::enableVertexAttribArray(unsigned long index, ExceptionCode& ec)
 {
+    if (index >= m_maxVertexAttribs) {
+        ec = INVALID_STATE_ERR;
+        return;
+    }
+    
+    if (index >= m_vertexAttribState.size())
+        m_vertexAttribState.resize(index + 1);
+        
+    m_vertexAttribState[index].enabled = true;
+    
     m_context->enableVertexAttribArray(index);
     cleanupAfterGraphicsCall(false);
 }
@@ -853,26 +1001,41 @@ bool WebGLRenderingContext::isEnabled(unsigned long cap)
 
 bool WebGLRenderingContext::isFramebuffer(WebGLFramebuffer* framebuffer)
 {
+    if (!framebuffer)
+        return false;
+
     return m_context->isFramebuffer(framebuffer);
 }
 
 bool WebGLRenderingContext::isProgram(WebGLProgram* program)
 {
+    if (!program)
+        return false;
+
     return m_context->isProgram(program);
 }
 
 bool WebGLRenderingContext::isRenderbuffer(WebGLRenderbuffer* renderbuffer)
 {
+    if (!renderbuffer)
+        return false;
+
     return m_context->isRenderbuffer(renderbuffer);
 }
 
 bool WebGLRenderingContext::isShader(WebGLShader* shader)
 {
+    if (!shader)
+        return false;
+
     return m_context->isShader(shader);
 }
 
 bool WebGLRenderingContext::isTexture(WebGLTexture* texture)
 {
+    if (!texture)
+        return false;
+
     return m_context->isTexture(texture);
 }
 
@@ -1415,14 +1578,24 @@ void WebGLRenderingContext::uniformMatrix4fv(long location, bool transpose, floa
     cleanupAfterGraphicsCall(false);
 }
 
-void WebGLRenderingContext::useProgram(WebGLProgram* program)
+void WebGLRenderingContext::useProgram(WebGLProgram* program, ExceptionCode& ec)
 {
+    if (!program || program->context() != this) {
+        ec = TYPE_MISMATCH_ERR;
+        return;
+    }
+        
     m_context->useProgram(program);
     cleanupAfterGraphicsCall(false);
 }
 
-void WebGLRenderingContext::validateProgram(WebGLProgram* program)
+void WebGLRenderingContext::validateProgram(WebGLProgram* program, ExceptionCode& ec)
 {
+    if (!program || program->context() != this) {
+        ec = TYPE_MISMATCH_ERR;
+        return;
+    }
+        
     m_context->validateProgram(program);
     cleanupAfterGraphicsCall(false);
 }
@@ -1515,8 +1688,33 @@ void WebGLRenderingContext::vertexAttrib4fv(unsigned long indx, float* v, int si
     cleanupAfterGraphicsCall(false);
 }
 
-void WebGLRenderingContext::vertexAttribPointer(unsigned long indx, long size, unsigned long type, bool normalized, unsigned long stride, unsigned long offset)
+void WebGLRenderingContext::vertexAttribPointer(unsigned long indx, long size, unsigned long type, bool normalized, unsigned long stride, unsigned long offset, ExceptionCode& ec)
 {
+    if (!m_boundArrayBuffer || indx >= m_maxVertexAttribs) {
+        ec = INVALID_STATE_ERR;
+        return;
+    }
+    
+    if (indx >= m_vertexAttribState.size())
+        m_vertexAttribState.resize(indx + 1);
+
+    // Determine the number of elements the bound buffer can hold, given the offset, size, type and stride
+    ec = 0;
+    long bytesPerElement = size * sizeInBytes(type, ec);
+    if (ec != 0)
+        return;
+        
+    if (stride != 0) {
+        if ((long) stride < bytesPerElement) {
+            ec = SYNTAX_ERR;
+            return;
+        }
+        
+        bytesPerElement = stride;
+    }
+        
+    m_vertexAttribState[indx].numElements = (m_boundArrayBuffer->byteLength(GraphicsContext3D::ARRAY_BUFFER) - offset) / bytesPerElement;
+
     m_context->vertexAttribPointer(indx, size, type, normalized, stride, offset);
     cleanupAfterGraphicsCall(false);
 }
@@ -1548,8 +1746,8 @@ void WebGLRenderingContext::addObject(CanvasObject* object)
 
 void WebGLRenderingContext::detachAndRemoveAllObjects()
 {
-    HashSet<CanvasObject*>::iterator pend = m_canvasObjects.end();
-    for (HashSet<CanvasObject*>::iterator it = m_canvasObjects.begin(); it != pend; ++it)
+    HashSet<RefPtr<CanvasObject> >::iterator pend = m_canvasObjects.end();
+    for (HashSet<RefPtr<CanvasObject> >::iterator it = m_canvasObjects.begin(); it != pend; ++it)
         (*it)->detachContext();
         
     m_canvasObjects.clear();
diff --git a/WebCore/html/canvas/WebGLRenderingContext.h b/WebCore/html/canvas/WebGLRenderingContext.h
index c3a560c..cc37342 100644
--- a/WebCore/html/canvas/WebGLRenderingContext.h
+++ b/WebCore/html/canvas/WebGLRenderingContext.h
@@ -73,9 +73,9 @@ class WebKitCSSMatrix;
         void blendFunc(unsigned long sfactor, unsigned long dfactor);
         void blendFuncSeparate(unsigned long srcRGB, unsigned long dstRGB, unsigned long srcAlpha, unsigned long dstAlpha);
 
-        void bufferData(unsigned long target, int size, unsigned long usage);
-        void bufferData(unsigned long target, WebGLArray* data, unsigned long usage);
-        void bufferSubData(unsigned long target, long offset, WebGLArray* data);
+        void bufferData(unsigned long target, int size, unsigned long usage, ExceptionCode&);
+        void bufferData(unsigned long target, WebGLArray* data, unsigned long usage, ExceptionCode&);
+        void bufferSubData(unsigned long target, long offset, WebGLArray* data, ExceptionCode&);
 
         unsigned long checkFramebufferStatus(unsigned long target);
         void clear(unsigned long mask);
@@ -110,14 +110,14 @@ class WebKitCSSMatrix;
         void depthFunc(unsigned long);
         void depthMask(bool);
         void depthRange(double zNear, double zFar);
-        void detachShader(WebGLProgram*, WebGLShader*, ExceptionCode& ec);
+        void detachShader(WebGLProgram*, WebGLShader*, ExceptionCode&);
         void disable(unsigned long cap);
-        void disableVertexAttribArray(unsigned long index);
-        void drawArrays(unsigned long mode, long first, long count);
-        void drawElements(unsigned long mode, unsigned long count, unsigned long type, long offset);
+        void disableVertexAttribArray(unsigned long index, ExceptionCode&);
+        void drawArrays(unsigned long mode, long first, long count, ExceptionCode&);
+        void drawElements(unsigned long mode, unsigned long count, unsigned long type, long offset, ExceptionCode&);
 
         void enable(unsigned long cap);
-        void enableVertexAttribArray(unsigned long index);
+        void enableVertexAttribArray(unsigned long index, ExceptionCode&);
         void finish();
         void flush();
         void framebufferRenderbuffer(unsigned long target, unsigned long attachment, unsigned long renderbuffertarget, WebGLRenderbuffer*, ExceptionCode& ec);
@@ -156,7 +156,7 @@ class WebKitCSSMatrix;
         // TBD
         // void glGetShaderPrecisionFormat (GLenum shadertype, GLenum precisiontype, GLint* range, GLint* precision);
 
-        String getShaderSource(WebGLShader*, ExceptionCode& ec);
+        String getShaderSource(WebGLShader*, ExceptionCode&);
         String getString(unsigned long name);
 
         float getTexParameterf(unsigned long target, unsigned long pname);
@@ -164,12 +164,12 @@ class WebKitCSSMatrix;
         int getTexParameteri(unsigned long target, unsigned long pname);
         PassRefPtr<WebGLIntArray> getTexParameteriv(unsigned long target, unsigned long pname);
 
-        float getUniformf(WebGLProgram* program, long location, ExceptionCode& ec);
-        PassRefPtr<WebGLFloatArray> getUniformfv(WebGLProgram* program, long location, ExceptionCode& ec);
+        float getUniformf(WebGLProgram* program, long location, ExceptionCode&);
+        PassRefPtr<WebGLFloatArray> getUniformfv(WebGLProgram* program, long location, ExceptionCode&);
         long getUniformi(WebGLProgram* program, long location, ExceptionCode& ec);
-        PassRefPtr<WebGLIntArray> getUniformiv(WebGLProgram* program, long location, ExceptionCode& ec);
+        PassRefPtr<WebGLIntArray> getUniformiv(WebGLProgram* program, long location, ExceptionCode&);
 
-        long getUniformLocation(WebGLProgram*, const String& name, ExceptionCode& ec);
+        long getUniformLocation(WebGLProgram*, const String& name, ExceptionCode&);
 
         float getVertexAttribf(unsigned long index, unsigned long pname);
         PassRefPtr<WebGLFloatArray> getVertexAttribfv(unsigned long index, unsigned long pname);
@@ -187,7 +187,7 @@ class WebKitCSSMatrix;
         bool isShader(WebGLShader*);
         bool isTexture(WebGLTexture*);
         void lineWidth(double);
-        void linkProgram(WebGLProgram*, ExceptionCode& ec);
+        void linkProgram(WebGLProgram*, ExceptionCode&);
         void pixelStorei(unsigned long pname, long param);
         void polygonOffset(double factor, double units);
         
@@ -197,7 +197,7 @@ class WebKitCSSMatrix;
         void renderbufferStorage(unsigned long target, unsigned long internalformat, unsigned long width, unsigned long height);
         void sampleCoverage(double value, bool invert);
         void scissor(long x, long y, unsigned long width, unsigned long height);
-        void shaderSource(WebGLShader*, const String&, ExceptionCode& ec);
+        void shaderSource(WebGLShader*, const String&, ExceptionCode&);
         void stencilFunc(unsigned long func, long ref, unsigned long mask);
         void stencilFuncSeparate(unsigned long face, unsigned long func, long ref, unsigned long mask);
         void stencilMask(unsigned long);
@@ -268,8 +268,8 @@ class WebKitCSSMatrix;
         void uniformMatrix4fv(long location, bool transpose, WebGLFloatArray* value);
         void uniformMatrix4fv(long location, bool transpose, float* value, int size);
 
-        void useProgram(WebGLProgram*);
-        void validateProgram(WebGLProgram*);
+        void useProgram(WebGLProgram*, ExceptionCode&);
+        void validateProgram(WebGLProgram*, ExceptionCode&);
 
         void vertexAttrib1f(unsigned long indx, float x);
         void vertexAttrib1fv(unsigned long indx, WebGLFloatArray* values);
@@ -284,7 +284,7 @@ class WebKitCSSMatrix;
         void vertexAttrib4fv(unsigned long indx, WebGLFloatArray* values);
         void vertexAttrib4fv(unsigned long indx, float* values, int size);
         void vertexAttribPointer(unsigned long indx, long size, unsigned long type, bool normalized,
-                                 unsigned long stride, unsigned long offset);
+                                 unsigned long stride, unsigned long offset, ExceptionCode&);
 
         void viewport(long x, long y, unsigned long width, unsigned long height);
 
@@ -314,12 +314,30 @@ class WebKitCSSMatrix;
                 markContextChanged();
         }
         
+        bool validateIndexArray(unsigned long count, unsigned long type, long offset, long& numElements);
+        bool validateRenderingState(long numElements);
+
         OwnPtr<GraphicsContext3D> m_context;
         bool m_needsUpdate;
         bool m_markedCanvasDirty;
         // FIXME: I think this is broken -- it does not increment any
         // reference counts, so may refer to destroyed objects.
-        HashSet<CanvasObject*> m_canvasObjects;
+        HashSet<RefPtr<CanvasObject> > m_canvasObjects;
+        
+        // List of bound VBO's. Used to maintain info about sizes for ARRAY_BUFFER and stored values for ELEMENT_ARRAY_BUFFER
+        RefPtr<WebGLBuffer> m_boundArrayBuffer;
+        RefPtr<WebGLBuffer> m_boundElementArrayBuffer;
+    
+        // Cached values for vertex attrib range checks
+        class VertexAttribState {
+        public:
+            VertexAttribState() : enabled(false), numElements(0) { }
+            bool enabled;
+            long numElements;
+        };
+        
+        Vector<VertexAttribState> m_vertexAttribState;
+        unsigned m_maxVertexAttribs;
     };
 
 } // namespace WebCore
diff --git a/WebCore/html/canvas/WebGLRenderingContext.idl b/WebCore/html/canvas/WebGLRenderingContext.idl
index cdd7428..e5dc4f5 100644
--- a/WebCore/html/canvas/WebGLRenderingContext.idl
+++ b/WebCore/html/canvas/WebGLRenderingContext.idl
@@ -472,13 +472,14 @@ module html {
         void         blendEquationSeparate(in unsigned long modeRGB, in unsigned long modeAlpha);
         void         blendFunc(in unsigned long sfactor, in unsigned long dfactor);
         void         blendFuncSeparate(in unsigned long srcRGB, in unsigned long dstRGB, in unsigned long srcAlpha, in unsigned long dstAlpha);
+
         // Supported forms:
         //   void bufferData (in GLenum target, in GLsizei size, in GLenum usage);
         //   void bufferData (in GLenum target, in WebGLArray data, in GLenum usage);
-        [Custom] void bufferData();
+        [Custom] void bufferData() raises(DOMException);
         // Supported forms:
         //   void bufferSubData (in GLenum target, in GLsizeiptr offset, in WebGLArray data);
-        [Custom] void bufferSubData();
+        [Custom] void bufferSubData() raises(DOMException);
 
         unsigned long checkFramebufferStatus(in unsigned long target);
         void         clear(in unsigned long mask);
@@ -516,12 +517,12 @@ module html {
         void         depthRange(in double zNear, in double zFar);
         void         detachShader(in WebGLProgram program, in WebGLShader shader) raises(DOMException);
         void         disable(in unsigned long cap);
-        void         disableVertexAttribArray(in unsigned long index);
-        void         drawArrays(in unsigned long mode, in long first, in unsigned long count);
-        void         drawElements (in unsigned long mode, in long count, in unsigned long type, in unsigned long offset);
+        void         disableVertexAttribArray(in unsigned long index) raises(DOMException);
+        void         drawArrays(in unsigned long mode, in long first, in unsigned long count) raises(DOMException);
+        void         drawElements (in unsigned long mode, in long count, in unsigned long type, in unsigned long offset) raises(DOMException);
 
         void         enable(in unsigned long cap);
-        void         enableVertexAttribArray(in unsigned long index);
+        void         enableVertexAttribArray(in unsigned long index) raises(DOMException);
         void         finish();
         void         flush();
         void         framebufferRenderbuffer(in unsigned long target, in unsigned long attachment, in unsigned long renderbuffertarget, in WebGLRenderbuffer renderbuffer) raises(DOMException);
@@ -669,8 +670,8 @@ module html {
         [Custom] void uniformMatrix3fv(in long location, in boolean transpose, in WebGLFloatArray array);
         [Custom] void uniformMatrix4fv(in long location, in boolean transpose, in WebGLFloatArray array);
 
-        void         useProgram(in WebGLProgram program);
-        void         validateProgram(in WebGLProgram program);
+        void         useProgram(in WebGLProgram program) raises(DOMException);
+        void         validateProgram(in WebGLProgram program) raises(DOMException);
 
         void         vertexAttrib1f(in unsigned long indx, in float x);
         [Custom] void         vertexAttrib1fv(in unsigned long indx, in WebGLFloatArray values);
@@ -681,7 +682,7 @@ module html {
         void         vertexAttrib4f(in unsigned long indx, in float x, in float y, in float z, in float w);
         [Custom] void         vertexAttrib4fv(in unsigned long indx, in WebGLFloatArray values);
         void         vertexAttribPointer(in unsigned long indx, in long size, in unsigned long type, in boolean normalized, 
-                                         in long stride, in unsigned long offset);
+                                         in long stride, in unsigned long offset) raises(DOMException);
 
         void         viewport(in long x, in long y, in unsigned long width, in unsigned long height);
     };
diff --git a/WebCore/html/canvas/WebGLShader.cpp b/WebCore/html/canvas/WebGLShader.cpp
index 2ed4101..a353b15 100644
--- a/WebCore/html/canvas/WebGLShader.cpp
+++ b/WebCore/html/canvas/WebGLShader.cpp
@@ -32,12 +32,12 @@
 
 namespace WebCore {
     
-PassRefPtr<WebGLShader> WebGLShader::create(WebGLRenderingContext* ctx, GraphicsContext3D::ShaderType type)
+PassRefPtr<WebGLShader> WebGLShader::create(WebGLRenderingContext* ctx, GraphicsContext3D::WebGLEnumType type)
 {
     return adoptRef(new WebGLShader(ctx, type));
 }
 
-WebGLShader::WebGLShader(WebGLRenderingContext* ctx, GraphicsContext3D::ShaderType type)
+WebGLShader::WebGLShader(WebGLRenderingContext* ctx, GraphicsContext3D::WebGLEnumType type)
     : CanvasObject(ctx)
 {
     setObject(context()->graphicsContext3D()->createShader(type));
diff --git a/WebCore/html/canvas/WebGLShader.h b/WebCore/html/canvas/WebGLShader.h
index c70190b..1ef912c 100644
--- a/WebCore/html/canvas/WebGLShader.h
+++ b/WebCore/html/canvas/WebGLShader.h
@@ -37,10 +37,10 @@ namespace WebCore {
     public:
         virtual ~WebGLShader() { deleteObject(); }
         
-        static PassRefPtr<WebGLShader> create(WebGLRenderingContext*, GraphicsContext3D::ShaderType);
+        static PassRefPtr<WebGLShader> create(WebGLRenderingContext*, GraphicsContext3D::WebGLEnumType);
         
     private:
-        WebGLShader(WebGLRenderingContext*, GraphicsContext3D::ShaderType);
+        WebGLShader(WebGLRenderingContext*, GraphicsContext3D::WebGLEnumType);
 
         virtual void _deleteObject(Platform3DObject);
     };
diff --git a/WebCore/platform/graphics/GraphicsContext3D.h b/WebCore/platform/graphics/GraphicsContext3D.h
index 8afd8aa..59e0c7a 100644
--- a/WebCore/platform/graphics/GraphicsContext3D.h
+++ b/WebCore/platform/graphics/GraphicsContext3D.h
@@ -76,8 +76,309 @@ namespace WebCore {
 
     class GraphicsContext3D : public Noncopyable {
     public:
-        enum ShaderType { FRAGMENT_SHADER, VERTEX_SHADER };
-    
+        enum WebGLEnumType {
+            DEPTH_BUFFER_BIT = 0x00000100,
+            STENCIL_BUFFER_BIT = 0x00000400,
+            COLOR_BUFFER_BIT = 0x00004000,
+            POINTS = 0x0000,
+            LINES = 0x0001,
+            LINE_LOOP = 0x0002,
+            LINE_STRIP = 0x0003,
+            TRIANGLES = 0x0004,
+            TRIANGLE_STRIP = 0x0005,
+            TRIANGLE_FAN = 0x0006,
+            ZERO = 0,
+            ONE = 1,
+            SRC_COLOR = 0x0300,
+            ONE_MINUS_SRC_COLOR = 0x0301,
+            SRC_ALPHA = 0x0302,
+            ONE_MINUS_SRC_ALPHA = 0x0303,
+            DST_ALPHA = 0x0304,
+            ONE_MINUS_DST_ALPHA = 0x0305,
+            DST_COLOR = 0x0306,
+            ONE_MINUS_DST_COLOR = 0x0307,
+            SRC_ALPHA_SATURATE = 0x0308,
+            FUNC_ADD = 0x8006,
+            BLEND_EQUATION = 0x8009,
+            BLEND_EQUATION_RGB = 0x8009,
+            BLEND_EQUATION_ALPHA = 0x883D,
+            FUNC_SUBTRACT = 0x800A,
+            FUNC_REVERSE_SUBTRACT = 0x800B,
+            BLEND_DST_RGB = 0x80C8,
+            BLEND_SRC_RGB = 0x80C9,
+            BLEND_DST_ALPHA = 0x80CA,
+            BLEND_SRC_ALPHA = 0x80CB,
+            CONSTANT_COLOR = 0x8001,
+            ONE_MINUS_CONSTANT_COLOR = 0x8002,
+            CONSTANT_ALPHA = 0x8003,
+            ONE_MINUS_CONSTANT_ALPHA = 0x8004,
+            BLEND_COLOR = 0x8005,
+            ARRAY_BUFFER = 0x8892,
+            ELEMENT_ARRAY_BUFFER = 0x8893,
+            ARRAY_BUFFER_BINDING = 0x8894,
+            ELEMENT_ARRAY_BUFFER_BINDING = 0x8895,
+            STREAM_DRAW = 0x88E0,
+            STATIC_DRAW = 0x88E4,
+            DYNAMIC_DRAW = 0x88E8,
+            BUFFER_SIZE = 0x8764,
+            BUFFER_USAGE = 0x8765,
+            CURRENT_VERTEX_ATTRIB = 0x8626,
+            FRONT = 0x0404,
+            BACK = 0x0405,
+            FRONT_AND_BACK = 0x0408,
+            TEXTURE_2D = 0x0DE1,
+            CULL_FACE = 0x0B44,
+            BLEND = 0x0BE2,
+            DITHER = 0x0BD0,
+            STENCIL_TEST = 0x0B90,
+            DEPTH_TEST = 0x0B71,
+            SCISSOR_TEST = 0x0C11,
+            POLYGON_OFFSET_FILL = 0x8037,
+            SAMPLE_ALPHA_TO_COVERAGE = 0x809E,
+            SAMPLE_COVERAGE = 0x80A0,
+            NO_ERROR = 0,
+            INVALID_ENUM = 0x0500,
+            INVALID_VALUE = 0x0501,
+            INVALID_OPERATION = 0x0502,
+            OUT_OF_MEMORY = 0x0505,
+            CW = 0x0900,
+            CCW = 0x0901,
+            LINE_WIDTH = 0x0B21,
+            ALIASED_POINT_SIZE_RANGE = 0x846D,
+            ALIASED_LINE_WIDTH_RANGE = 0x846E,
+            CULL_FACE_MODE = 0x0B45,
+            FRONT_FACE = 0x0B46,
+            DEPTH_RANGE = 0x0B70,
+            DEPTH_WRITEMASK = 0x0B72,
+            DEPTH_CLEAR_VALUE = 0x0B73,
+            DEPTH_FUNC = 0x0B74,
+            STENCIL_CLEAR_VALUE = 0x0B91,
+            STENCIL_FUNC = 0x0B92,
+            STENCIL_FAIL = 0x0B94,
+            STENCIL_PASS_DEPTH_FAIL = 0x0B95,
+            STENCIL_PASS_DEPTH_PASS = 0x0B96,
+            STENCIL_REF = 0x0B97,
+            STENCIL_VALUE_MASK = 0x0B93,
+            STENCIL_WRITEMASK = 0x0B98,
+            STENCIL_BACK_FUNC = 0x8800,
+            STENCIL_BACK_FAIL = 0x8801,
+            STENCIL_BACK_PASS_DEPTH_FAIL = 0x8802,
+            STENCIL_BACK_PASS_DEPTH_PASS = 0x8803,
+            STENCIL_BACK_REF = 0x8CA3,
+            STENCIL_BACK_VALUE_MASK = 0x8CA4,
+            STENCIL_BACK_WRITEMASK = 0x8CA5,
+            VIEWPORT = 0x0BA2,
+            SCISSOR_BOX = 0x0C10,
+            COLOR_CLEAR_VALUE = 0x0C22,
+            COLOR_WRITEMASK = 0x0C23,
+            UNPACK_ALIGNMENT = 0x0CF5,
+            PACK_ALIGNMENT = 0x0D05,
+            MAX_TEXTURE_SIZE = 0x0D33,
+            MAX_VIEWPORT_DIMS = 0x0D3A,
+            SUBPIXEL_BITS = 0x0D50,
+            RED_BITS = 0x0D52,
+            GREEN_BITS = 0x0D53,
+            BLUE_BITS = 0x0D54,
+            ALPHA_BITS = 0x0D55,
+            DEPTH_BITS = 0x0D56,
+            STENCIL_BITS = 0x0D57,
+            POLYGON_OFFSET_UNITS = 0x2A00,
+            POLYGON_OFFSET_FACTOR = 0x8038,
+            TEXTURE_BINDING_2D = 0x8069,
+            SAMPLE_BUFFERS = 0x80A8,
+            SAMPLES = 0x80A9,
+            SAMPLE_COVERAGE_VALUE = 0x80AA,
+            SAMPLE_COVERAGE_INVERT = 0x80AB,
+            NUM_COMPRESSED_TEXTURE_FORMATS = 0x86A2,
+            COMPRESSED_TEXTURE_FORMATS = 0x86A3,
+            DONT_CARE = 0x1100,
+            FASTEST = 0x1101,
+            NICEST = 0x1102,
+            GENERATE_MIPMAP_HINT = 0x8192,
+            BYTE = 0x1400,
+            UNSIGNED_BYTE = 0x1401,
+            SHORT = 0x1402,
+            UNSIGNED_SHORT = 0x1403,
+            INT = 0x1404,
+            UNSIGNED_INT = 0x1405,
+            FLOAT = 0x1406,
+            FIXED = 0x140C,
+            DEPTH_COMPONENT = 0x1902,
+            ALPHA = 0x1906,
+            RGB = 0x1907,
+            RGBA = 0x1908,
+            LUMINANCE = 0x1909,
+            LUMINANCE_ALPHA = 0x190A,
+            UNSIGNED_SHORT_4_4_4_4 = 0x8033,
+            UNSIGNED_SHORT_5_5_5_1 = 0x8034,
+            UNSIGNED_SHORT_5_6_5 = 0x8363,
+            FRAGMENT_SHADER = 0x8B30,
+            VERTEX_SHADER = 0x8B31,
+            MAX_VERTEX_ATTRIBS = 0x8869,
+            MAX_VERTEX_UNIFORM_VECTORS = 0x8DFB,
+            MAX_VARYING_VECTORS = 0x8DFC,
+            MAX_COMBINED_TEXTURE_IMAGE_UNITS = 0x8B4D,
+            MAX_VERTEX_TEXTURE_IMAGE_UNITS = 0x8B4C,
+            MAX_TEXTURE_IMAGE_UNITS = 0x8872,
+            MAX_FRAGMENT_UNIFORM_VECTORS = 0x8DFD,
+            SHADER_TYPE = 0x8B4F,
+            DELETE_STATUS = 0x8B80,
+            LINK_STATUS = 0x8B82,
+            VALIDATE_STATUS = 0x8B83,
+            ATTACHED_SHADERS = 0x8B85,
+            ACTIVE_UNIFORMS = 0x8B86,
+            ACTIVE_UNIFORM_MAX_LENGTH = 0x8B87,
+            ACTIVE_ATTRIBUTES = 0x8B89,
+            ACTIVE_ATTRIBUTE_MAX_LENGTH = 0x8B8A,
+            SHADING_LANGUAGE_VERSION = 0x8B8C,
+            CURRENT_PROGRAM = 0x8B8D,
+            NEVER = 0x0200,
+            LESS = 0x0201,
+            EQUAL = 0x0202,
+            LEQUAL = 0x0203,
+            GREATER = 0x0204,
+            NOTEQUAL = 0x0205,
+            GEQUAL = 0x0206,
+            ALWAYS = 0x0207,
+            KEEP = 0x1E00,
+            REPLACE = 0x1E01,
+            INCR = 0x1E02,
+            DECR = 0x1E03,
+            INVERT = 0x150A,
+            INCR_WRAP = 0x8507,
+            DECR_WRAP = 0x8508,
+            VENDOR = 0x1F00,
+            RENDERER = 0x1F01,
+            VERSION = 0x1F02,
+            EXTENSIONS = 0x1F03,
+            NEAREST = 0x2600,
+            LINEAR = 0x2601,
+            NEAREST_MIPMAP_NEAREST = 0x2700,
+            LINEAR_MIPMAP_NEAREST = 0x2701,
+            NEAREST_MIPMAP_LINEAR = 0x2702,
+            LINEAR_MIPMAP_LINEAR = 0x2703,
+            TEXTURE_MAG_FILTER = 0x2800,
+            TEXTURE_MIN_FILTER = 0x2801,
+            TEXTURE_WRAP_S = 0x2802,
+            TEXTURE_WRAP_T = 0x2803,
+            TEXTURE = 0x1702,
+            TEXTURE_CUBE_MAP = 0x8513,
+            TEXTURE_BINDING_CUBE_MAP = 0x8514,
+            TEXTURE_CUBE_MAP_POSITIVE_X = 0x8515,
+            TEXTURE_CUBE_MAP_NEGATIVE_X = 0x8516,
+            TEXTURE_CUBE_MAP_POSITIVE_Y = 0x8517,
+            TEXTURE_CUBE_MAP_NEGATIVE_Y = 0x8518,
+            TEXTURE_CUBE_MAP_POSITIVE_Z = 0x8519,
+            TEXTURE_CUBE_MAP_NEGATIVE_Z = 0x851A,
+            MAX_CUBE_MAP_TEXTURE_SIZE = 0x851C,
+            TEXTURE0 = 0x84C0,
+            TEXTURE1 = 0x84C1,
+            TEXTURE2 = 0x84C2,
+            TEXTURE3 = 0x84C3,
+            TEXTURE4 = 0x84C4,
+            TEXTURE5 = 0x84C5,
+            TEXTURE6 = 0x84C6,
+            TEXTURE7 = 0x84C7,
+            TEXTURE8 = 0x84C8,
+            TEXTURE9 = 0x84C9,
+            TEXTURE10 = 0x84CA,
+            TEXTURE11 = 0x84CB,
+            TEXTURE12 = 0x84CC,
+            TEXTURE13 = 0x84CD,
+            TEXTURE14 = 0x84CE,
+            TEXTURE15 = 0x84CF,
+            TEXTURE16 = 0x84D0,
+            TEXTURE17 = 0x84D1,
+            TEXTURE18 = 0x84D2,
+            TEXTURE19 = 0x84D3,
+            TEXTURE20 = 0x84D4,
+            TEXTURE21 = 0x84D5,
+            TEXTURE22 = 0x84D6,
+            TEXTURE23 = 0x84D7,
+            TEXTURE24 = 0x84D8,
+            TEXTURE25 = 0x84D9,
+            TEXTURE26 = 0x84DA,
+            TEXTURE27 = 0x84DB,
+            TEXTURE28 = 0x84DC,
+            TEXTURE29 = 0x84DD,
+            TEXTURE30 = 0x84DE,
+            TEXTURE31 = 0x84DF,
+            ACTIVE_TEXTURE = 0x84E0,
+            REPEAT = 0x2901,
+            CLAMP_TO_EDGE = 0x812F,
+            MIRRORED_REPEAT = 0x8370,
+            FLOAT_VEC2 = 0x8B50,
+            FLOAT_VEC3 = 0x8B51,
+            FLOAT_VEC4 = 0x8B52,
+            INT_VEC2 = 0x8B53,
+            INT_VEC3 = 0x8B54,
+            INT_VEC4 = 0x8B55,
+            BOOL = 0x8B56,
+            BOOL_VEC2 = 0x8B57,
+            BOOL_VEC3 = 0x8B58,
+            BOOL_VEC4 = 0x8B59,
+            FLOAT_MAT2 = 0x8B5A,
+            FLOAT_MAT3 = 0x8B5B,
+            FLOAT_MAT4 = 0x8B5C,
+            SAMPLER_2D = 0x8B5E,
+            SAMPLER_CUBE = 0x8B60,
+            VERTEX_ATTRIB_ARRAY_ENABLED = 0x8622,
+            VERTEX_ATTRIB_ARRAY_SIZE = 0x8623,
+            VERTEX_ATTRIB_ARRAY_STRIDE = 0x8624,
+            VERTEX_ATTRIB_ARRAY_TYPE = 0x8625,
+            VERTEX_ATTRIB_ARRAY_NORMALIZED = 0x886A,
+            VERTEX_ATTRIB_ARRAY_POINTER = 0x8645,
+            VERTEX_ATTRIB_ARRAY_BUFFER_BINDING = 0x889F,
+            IMPLEMENTATION_COLOR_READ_TYPE = 0x8B9A,
+            IMPLEMENTATION_COLOR_READ_FORMAT = 0x8B9B,
+            COMPILE_STATUS = 0x8B81,
+            INFO_LOG_LENGTH = 0x8B84,
+            SHADER_SOURCE_LENGTH = 0x8B88,
+            SHADER_COMPILER = 0x8DFA,
+            SHADER_BINARY_FORMATS = 0x8DF8,
+            NUM_SHADER_BINARY_FORMATS = 0x8DF9,
+            LOW_FLOAT = 0x8DF0,
+            MEDIUM_FLOAT = 0x8DF1,
+            HIGH_FLOAT = 0x8DF2,
+            LOW_INT = 0x8DF3,
+            MEDIUM_INT = 0x8DF4,
+            HIGH_INT = 0x8DF5,
+            FRAMEBUFFER = 0x8D40,
+            RENDERBUFFER = 0x8D41,
+            RGBA4 = 0x8056,
+            RGB5_A1 = 0x8057,
+            RGB565 = 0x8D62,
+            DEPTH_COMPONENT16 = 0x81A5,
+            STENCIL_INDEX = 0x1901,
+            STENCIL_INDEX8 = 0x8D48,
+            RENDERBUFFER_WIDTH = 0x8D42,
+            RENDERBUFFER_HEIGHT = 0x8D43,
+            RENDERBUFFER_INTERNAL_FORMAT = 0x8D44,
+            RENDERBUFFER_RED_SIZE = 0x8D50,
+            RENDERBUFFER_GREEN_SIZE = 0x8D51,
+            RENDERBUFFER_BLUE_SIZE = 0x8D52,
+            RENDERBUFFER_ALPHA_SIZE = 0x8D53,
+            RENDERBUFFER_DEPTH_SIZE = 0x8D54,
+            RENDERBUFFER_STENCIL_SIZE = 0x8D55,
+            FRAMEBUFFER_ATTACHMENT_OBJECT_TYPE = 0x8CD0,
+            FRAMEBUFFER_ATTACHMENT_OBJECT_NAME = 0x8CD1,
+            FRAMEBUFFER_ATTACHMENT_TEXTURE_LEVEL = 0x8CD2,
+            FRAMEBUFFER_ATTACHMENT_TEXTURE_CUBE_MAP_FACE = 0x8CD3,
+            COLOR_ATTACHMENT0 = 0x8CE0,
+            DEPTH_ATTACHMENT = 0x8D00,
+            STENCIL_ATTACHMENT = 0x8D20,
+            NONE = 0,
+            FRAMEBUFFER_COMPLETE = 0x8CD5,
+            FRAMEBUFFER_INCOMPLETE_ATTACHMENT = 0x8CD6,
+            FRAMEBUFFER_INCOMPLETE_MISSING_ATTACHMENT = 0x8CD7,
+            FRAMEBUFFER_INCOMPLETE_DIMENSIONS = 0x8CD9,
+            FRAMEBUFFER_UNSUPPORTED = 0x8CDD,
+            FRAMEBUFFER_BINDING = 0x8CA6,
+            RENDERBUFFER_BINDING = 0x8CA7,
+            MAX_RENDERBUFFER_SIZE = 0x84E8,
+            INVALID_FRAMEBUFFER_OPERATION = 0x0506
+        };
+        
         static PassOwnPtr<GraphicsContext3D> create();
         virtual ~GraphicsContext3D();
 
@@ -303,7 +604,7 @@ namespace WebCore {
         unsigned createFramebuffer();
         unsigned createProgram();
         unsigned createRenderbuffer();
-        unsigned createShader(ShaderType);
+        unsigned createShader(unsigned long);
         unsigned createTexture();
         
         void deleteBuffer(unsigned);
diff --git a/WebCore/platform/graphics/mac/GraphicsContext3DMac.cpp b/WebCore/platform/graphics/mac/GraphicsContext3DMac.cpp
index 30daabf..2187f4c 100644
--- a/WebCore/platform/graphics/mac/GraphicsContext3DMac.cpp
+++ b/WebCore/platform/graphics/mac/GraphicsContext3DMac.cpp
@@ -1683,7 +1683,7 @@ unsigned GraphicsContext3D::createRenderbuffer()
     return o;
 }
 
-unsigned GraphicsContext3D::createShader(ShaderType type)
+unsigned GraphicsContext3D::createShader(unsigned long type)
 {
     ensureContext(m_contextObj);
     return glCreateShader((type == FRAGMENT_SHADER) ? GL_FRAGMENT_SHADER : GL_VERTEX_SHADER);

-- 
WebKit Debian packaging



More information about the Pkg-webkit-commits mailing list