[SCM] WebKit Debian packaging branch, debian/experimental, updated. upstream/1.3.3-9427-gc2be6fc
zmo at google.com
zmo at google.com
Wed Dec 22 15:46:00 UTC 2010
The following commit has been merged in the debian/experimental branch:
commit 82dac7ccd18e26f2727ecf22cc38012abfc53421
Author: zmo at google.com <zmo at google.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date: Fri Nov 12 00:02:13 2010 +0000
2010-11-10 Zhenyao Mo <zmo at google.com>
Reviewed by Kenneth Russell.
bufferData/bufferSubData should not crash with null data input
https://bugs.webkit.org/show_bug.cgi?id=49350
* html/canvas/WebGLRenderingContext.cpp: return early if input data is null.
(WebCore::WebGLRenderingContext::bufferData):
(WebCore::WebGLRenderingContext::bufferSubData):
2010-11-10 Zhenyao Mo <zmo at google.com>
Reviewed by Kenneth Russell.
bufferData/bufferSubData should not crash with null data input
https://bugs.webkit.org/show_bug.cgi?id=49350
* fast/canvas/webgl/buffer-data-array-buffer-expected.txt:
* fast/canvas/webgl/buffer-data-array-buffer.html: test the null data input cases.
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@71861 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 46f6a49..21e3fe1 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,13 @@
+2010-11-10 Zhenyao Mo <zmo at google.com>
+
+ Reviewed by Kenneth Russell.
+
+ bufferData/bufferSubData should not crash with null data input
+ https://bugs.webkit.org/show_bug.cgi?id=49350
+
+ * fast/canvas/webgl/buffer-data-array-buffer-expected.txt:
+ * fast/canvas/webgl/buffer-data-array-buffer.html: test the null data input cases.
+
2010-11-11 Zhenyao Mo <zmo at google.com>
Unreviewed, build fix, update test results.
diff --git a/LayoutTests/fast/canvas/webgl/buffer-data-array-buffer-expected.txt b/LayoutTests/fast/canvas/webgl/buffer-data-array-buffer-expected.txt
index 87410c2..b84dbf8 100644
--- a/LayoutTests/fast/canvas/webgl/buffer-data-array-buffer-expected.txt
+++ b/LayoutTests/fast/canvas/webgl/buffer-data-array-buffer-expected.txt
@@ -6,10 +6,11 @@ Regression test for https://bugs.webkit.org/show_bug.cgi?id=41884 : Implement bu
PASS gl is non-null.
PASS array is non-null.
PASS [object WebGLBuffer] is non-null.
-PASS gl.getError() is gl.INVALID_OPERATION
-PASS gl.getError() is gl.NO_ERROR
-PASS gl.getError() is gl.NO_ERROR
-PASS gl.getError() is gl.NO_ERROR
+PASS getError was expected value: INVALID_OPERATION :
+PASS getError was expected value: NO_ERROR :
+PASS getError was expected value: NO_ERROR :
+PASS getError was expected value: NO_ERROR :
+PASS getError was expected value: NO_ERROR :
PASS successfullyParsed is true
TEST COMPLETE
diff --git a/LayoutTests/fast/canvas/webgl/buffer-data-array-buffer.html b/LayoutTests/fast/canvas/webgl/buffer-data-array-buffer.html
index f827293..9b66d16 100644
--- a/LayoutTests/fast/canvas/webgl/buffer-data-array-buffer.html
+++ b/LayoutTests/fast/canvas/webgl/buffer-data-array-buffer.html
@@ -23,18 +23,25 @@ var buf = gl.createBuffer();
shouldBeNonNull(buf);
gl.bufferData(gl.ARRAY_BUFFER, array, gl.STATIC_DRAW);
-shouldBe("gl.getError()", "gl.INVALID_OPERATION");
+glErrorShouldBe(gl, gl.INVALID_OPERATION);
gl.bindBuffer(gl.ARRAY_BUFFER, buf);
-shouldBe("gl.getError()", "gl.NO_ERROR");
+glErrorShouldBe(gl, gl.NO_ERROR);
+
+// This should not crash, but the selection of the overload is ambiguous per Web IDL.
+gl.bufferData(gl.ARRAY_BUFFER, null, gl.STATIC_DRAW);
+gl.getError();
gl.bufferData(gl.ARRAY_BUFFER, array, gl.STATIC_DRAW);
-shouldBe("gl.getError()", "gl.NO_ERROR");
+glErrorShouldBe(gl, gl.NO_ERROR);
array = new ArrayBuffer(64);
gl.bufferSubData(gl.ARRAY_BUFFER, 10, array);
-shouldBe("gl.getError()", "gl.NO_ERROR");
+glErrorShouldBe(gl, gl.NO_ERROR);
+
+gl.bufferSubData(gl.ARRAY_BUFFER, 10, null);
+glErrorShouldBe(gl, gl.NO_ERROR);
successfullyParsed = true;
</script>
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 4035418..10a5c7c 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -2,6 +2,17 @@
Reviewed by Kenneth Russell.
+ bufferData/bufferSubData should not crash with null data input
+ https://bugs.webkit.org/show_bug.cgi?id=49350
+
+ * html/canvas/WebGLRenderingContext.cpp: return early if input data is null.
+ (WebCore::WebGLRenderingContext::bufferData):
+ (WebCore::WebGLRenderingContext::bufferSubData):
+
+2010-11-10 Zhenyao Mo <zmo at google.com>
+
+ Reviewed by Kenneth Russell.
+
Implement UNPACK_COLORSPACE_CONVERSION_WEBGL
https://bugs.webkit.org/show_bug.cgi?id=47196
diff --git a/WebCore/html/canvas/WebGLRenderingContext.cpp b/WebCore/html/canvas/WebGLRenderingContext.cpp
index 240b894..fa19b0d 100644
--- a/WebCore/html/canvas/WebGLRenderingContext.cpp
+++ b/WebCore/html/canvas/WebGLRenderingContext.cpp
@@ -424,6 +424,10 @@ void WebGLRenderingContext::bufferData(unsigned long target, ArrayBuffer* data,
WebGLBuffer* buffer = validateBufferDataParameters(target, usage);
if (!buffer)
return;
+ if (!data) {
+ m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+ return;
+ }
if (!isErrorGeneratedOnOutOfBoundsAccesses()) {
if (!buffer->associateBufferData(data)) {
m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
@@ -443,6 +447,10 @@ void WebGLRenderingContext::bufferData(unsigned long target, ArrayBufferView* da
WebGLBuffer* buffer = validateBufferDataParameters(target, usage);
if (!buffer)
return;
+ if (!data) {
+ m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+ return;
+ }
if (!isErrorGeneratedOnOutOfBoundsAccesses()) {
if (!buffer->associateBufferData(data)) {
m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
@@ -462,6 +470,8 @@ void WebGLRenderingContext::bufferSubData(unsigned long target, long offset, Arr
WebGLBuffer* buffer = validateBufferDataParameters(target, GraphicsContext3D::STATIC_DRAW);
if (!buffer)
return;
+ if (!data)
+ return;
if (!isErrorGeneratedOnOutOfBoundsAccesses()) {
if (!buffer->associateBufferSubData(offset, data)) {
m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
@@ -481,6 +491,8 @@ void WebGLRenderingContext::bufferSubData(unsigned long target, long offset, Arr
WebGLBuffer* buffer = validateBufferDataParameters(target, GraphicsContext3D::STATIC_DRAW);
if (!buffer)
return;
+ if (!data)
+ return;
if (!isErrorGeneratedOnOutOfBoundsAccesses()) {
if (!buffer->associateBufferSubData(offset, data)) {
m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
--
WebKit Debian packaging
More information about the Pkg-webkit-commits
mailing list