Diff
Modified: branches/safari-605-branch/LayoutTests/ChangeLog (227024 => 227025)
--- branches/safari-605-branch/LayoutTests/ChangeLog 2018-01-17 05:04:07 UTC (rev 227024)
+++ branches/safari-605-branch/LayoutTests/ChangeLog 2018-01-17 05:04:10 UTC (rev 227025)
@@ -1,5 +1,20 @@
2018-01-16 Jason Marcell <[email protected]>
+ Cherry-pick r226908. rdar://problem/36568060
+
+ 2018-01-12 Dean Jackson <[email protected]>
+
+ drawElements should be invalid if vertexAttrib0 doesn't have data
+ https://bugs.webkit.org/show_bug.cgi?id=181609
+ <rdar://problem/36392883>
+
+ Reviewed by Antoine Quint.
+
+ * fast/canvas/webgl/drawElements-empty-vertex-data-expected.txt: Added.
+ * fast/canvas/webgl/drawElements-empty-vertex-data.html: Added.
+
+2018-01-16 Jason Marcell <[email protected]>
+
Cherry-pick r226906. rdar://problem/36568006
2018-01-12 Youenn Fablet <[email protected]>
Added: branches/safari-605-branch/LayoutTests/fast/canvas/webgl/drawElements-empty-vertex-data-expected.txt (0 => 227025)
--- branches/safari-605-branch/LayoutTests/fast/canvas/webgl/drawElements-empty-vertex-data-expected.txt (rev 0)
+++ branches/safari-605-branch/LayoutTests/fast/canvas/webgl/drawElements-empty-vertex-data-expected.txt 2018-01-17 05:04:10 UTC (rev 227025)
@@ -0,0 +1,2 @@
+CONSOLE MESSAGE: line 27: WebGL: INVALID_OPERATION: drawElements: attempt to access out of bounds arrays
+PASS: Unable to draw with invalid vertexAttribArray0
Added: branches/safari-605-branch/LayoutTests/fast/canvas/webgl/drawElements-empty-vertex-data.html (0 => 227025)
--- branches/safari-605-branch/LayoutTests/fast/canvas/webgl/drawElements-empty-vertex-data.html (rev 0)
+++ branches/safari-605-branch/LayoutTests/fast/canvas/webgl/drawElements-empty-vertex-data.html 2018-01-17 05:04:10 UTC (rev 227025)
@@ -0,0 +1,32 @@
+<canvas></canvas>
+<div></div>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+
+let gl = document.querySelector("canvas").getContext("webgl");
+
+let shader1 = gl.createShader(gl.VERTEX_SHADER);
+gl.shaderSource(shader1, "attribute vec2 pos; void main() { gl_Position = vec4(pos, 0, 1); }");
+gl.compileShader(shader1);
+
+let shader2 = gl.createShader(gl.FRAGMENT_SHADER);
+gl.shaderSource(shader2, "precision mediump float; void main() { gl_FragColor = vec4(0,0.8,0,1); }");
+gl.compileShader(shader2);
+
+let program = gl.createProgram();
+gl.attachShader(program, shader1);
+gl.attachShader(program, shader2);
+gl.linkProgram(program);
+gl.useProgram(program);
+
+let buffer = gl.createBuffer();
+gl.bindBuffer(gl.ELEMENT_ARRAY_BUFFER, buffer);
+gl.bufferData(gl.ELEMENT_ARRAY_BUFFER, new ArrayBuffer(1), gl.STREAM_DRAW);
+gl.enableVertexAttribArray(0);
+gl.drawElements(gl.LINE_STRIP, 1, gl.UNSIGNED_BYTE, 0);
+if (gl.getError() == gl.INVALID_OPERATION)
+ document.querySelector("div").textContent = "PASS: Unable to draw with invalid vertexAttribArray0";
+else
+ document.querySelector("div").textContent = "FAIL: Was able to draw with invalid vertexAttribArray0";
+</script>
Modified: branches/safari-605-branch/Source/WebCore/ChangeLog (227024 => 227025)
--- branches/safari-605-branch/Source/WebCore/ChangeLog 2018-01-17 05:04:07 UTC (rev 227024)
+++ branches/safari-605-branch/Source/WebCore/ChangeLog 2018-01-17 05:04:10 UTC (rev 227025)
@@ -1,5 +1,26 @@
2018-01-16 Jason Marcell <[email protected]>
+ Cherry-pick r226908. rdar://problem/36568060
+
+ 2018-01-12 Dean Jackson <[email protected]>
+
+ drawElements should be invalid if vertexAttrib0 doesn't have data
+ https://bugs.webkit.org/show_bug.cgi?id=181609
+ <rdar://problem/36392883>
+
+ Reviewed by Antoine Quint.
+
+ If a vertex attribute has been enabled, but no data provided, then
+ draw validation should fail.
+
+ Test: fast/canvas/webgl/drawElements-empty-vertex-data.html
+
+ * html/canvas/WebGLRenderingContextBase.cpp:
+ (WebCore::WebGLRenderingContextBase::validateVertexAttributes): If there were
+ never any data in the vertex buffer, then we incorrectly compared with 0.
+
+2018-01-16 Jason Marcell <[email protected]>
+
Cherry-pick r226906. rdar://problem/36568006
2018-01-12 Youenn Fablet <[email protected]>
Modified: branches/safari-605-branch/Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp (227024 => 227025)
--- branches/safari-605-branch/Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp 2018-01-17 05:04:07 UTC (rev 227024)
+++ branches/safari-605-branch/Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp 2018-01-17 05:04:10 UTC (rev 227025)
@@ -1924,6 +1924,8 @@
// For the last element, we will only touch the data for the
// element and nothing beyond it.
int bytesRemaining = static_cast<int>(state.bufferBinding->byteLength() - state.offset);
+ if (bytesRemaining <= 0)
+ return false;
unsigned numElements = 0;
ASSERT(state.stride > 0);
if (bytesRemaining >= state.bytesPerElement)
