Title: [185128] trunk
Revision
185128
Author
d...@apple.com
Date
2015-06-02 15:11:32 -0700 (Tue, 02 Jun 2015)

Log Message

Crash in GraphicsContext3D::getInternalFramebufferSize
https://bugs.webkit.org/show_bug.cgi?id=145479
<rdar://problem/16461048>

Reviewed by Eric Carlson.

Source/WebCore:

If we are in an unitialized or lost state, don't try to access the context.

In order to test this, I added an Internal setting that always
forces WebGL into a pending state.

Test: fast/canvas/webgl/useWhilePending.html

* html/canvas/WebGLRenderingContextBase.cpp:
(WebCore::WebGLRenderingContextBase::create): Check internal settings for
a forced pending state.
(WebCore::WebGLRenderingContextBase::drawingBufferWidth): Guard against a pending state.
(WebCore::WebGLRenderingContextBase::drawingBufferHeight): Ditto.
* page/Settings.cpp: New Internal setting for forcing a pending policy.
(WebCore::Settings::Settings):
(WebCore::Settings::setForcePendingWebGLPolicy):
* page/Settings.h:
(WebCore::Settings::isForcePendingWebGLPolicy):
* testing/InternalSettings.cpp:
(WebCore::InternalSettings::Backup::Backup):
(WebCore::InternalSettings::Backup::restoreTo):
(WebCore::InternalSettings::setForcePendingWebGLPolicy):
* testing/InternalSettings.h:
* testing/InternalSettings.idl:

LayoutTests:

Attemps to use a WebGL context while it is in the pending state.

* fast/canvas/webgl/useWhilePending-expected.txt: Added.
* fast/canvas/webgl/useWhilePending.html: Added.

Modified Paths

Added Paths

Diff

Modified: trunk/LayoutTests/ChangeLog (185127 => 185128)


--- trunk/LayoutTests/ChangeLog	2015-06-02 22:02:35 UTC (rev 185127)
+++ trunk/LayoutTests/ChangeLog	2015-06-02 22:11:32 UTC (rev 185128)
@@ -1,3 +1,16 @@
+2015-06-02  Dean Jackson  <d...@apple.com>
+
+        Crash in GraphicsContext3D::getInternalFramebufferSize
+        https://bugs.webkit.org/show_bug.cgi?id=145479
+        <rdar://problem/16461048>
+
+        Reviewed by Eric Carlson.
+
+        Attemps to use a WebGL context while it is in the pending state.
+
+        * fast/canvas/webgl/useWhilePending-expected.txt: Added.
+        * fast/canvas/webgl/useWhilePending.html: Added.
+
 2015-06-02  Said Abou-Hallawa  <sabouhall...@apple.com>
 
         Fix Windows layout test failure following <http://trac.webkit.org/changeset/185095>

Added: trunk/LayoutTests/fast/canvas/webgl/useWhilePending-expected.txt (0 => 185128)


--- trunk/LayoutTests/fast/canvas/webgl/useWhilePending-expected.txt	                        (rev 0)
+++ trunk/LayoutTests/fast/canvas/webgl/useWhilePending-expected.txt	2015-06-02 22:11:32 UTC (rev 185128)
@@ -0,0 +1 @@
+Should not crash.
Property changes on: trunk/LayoutTests/fast/canvas/webgl/useWhilePending-expected.txt
___________________________________________________________________

Added: svn:mime-type

Added: svn:keywords

Added: svn:eol-style

Added: trunk/LayoutTests/fast/canvas/webgl/useWhilePending.html (0 => 185128)


--- trunk/LayoutTests/fast/canvas/webgl/useWhilePending.html	                        (rev 0)
+++ trunk/LayoutTests/fast/canvas/webgl/useWhilePending.html	2015-06-02 22:11:32 UTC (rev 185128)
@@ -0,0 +1,23 @@
+<script>
+if (window.testRunner) {
+    window.internals.settings.setForcePendingWebGLPolicy(true);
+    testRunner.dumpAsText();
+    testRunner.waitUntilDone();
+}
+
+window.addEventListener("load", function () {
+
+    var canvas = document.createElement("canvas");
+    canvas.width = 100;
+    canvas.height = 100;
+    var gl = canvas.getContext("webgl");
+    var foo = gl.drawingBufferWidth;
+    foo = gl.drawingBufferHeight;
+
+    if (window.testRunner)
+        testRunner.notifyDone();
+
+}, false);
+</script>
+
+Should not crash.
Property changes on: trunk/LayoutTests/fast/canvas/webgl/useWhilePending.html
___________________________________________________________________

Added: svn:mime-type

Added: svn:keywords

Added: svn:eol-style

Modified: trunk/Source/WebCore/ChangeLog (185127 => 185128)


--- trunk/Source/WebCore/ChangeLog	2015-06-02 22:02:35 UTC (rev 185127)
+++ trunk/Source/WebCore/ChangeLog	2015-06-02 22:11:32 UTC (rev 185128)
@@ -1,3 +1,35 @@
+2015-06-02  Dean Jackson  <d...@apple.com>
+
+        Crash in GraphicsContext3D::getInternalFramebufferSize
+        https://bugs.webkit.org/show_bug.cgi?id=145479
+        <rdar://problem/16461048>
+
+        Reviewed by Eric Carlson.
+
+        If we are in an unitialized or lost state, don't try to access the context.
+
+        In order to test this, I added an Internal setting that always
+        forces WebGL into a pending state.
+
+        Test: fast/canvas/webgl/useWhilePending.html
+
+        * html/canvas/WebGLRenderingContextBase.cpp:
+        (WebCore::WebGLRenderingContextBase::create): Check internal settings for
+        a forced pending state.
+        (WebCore::WebGLRenderingContextBase::drawingBufferWidth): Guard against a pending state.
+        (WebCore::WebGLRenderingContextBase::drawingBufferHeight): Ditto.
+        * page/Settings.cpp: New Internal setting for forcing a pending policy.
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setForcePendingWebGLPolicy):
+        * page/Settings.h:
+        (WebCore::Settings::isForcePendingWebGLPolicy):
+        * testing/InternalSettings.cpp:
+        (WebCore::InternalSettings::Backup::Backup):
+        (WebCore::InternalSettings::Backup::restoreTo):
+        (WebCore::InternalSettings::setForcePendingWebGLPolicy):
+        * testing/InternalSettings.h:
+        * testing/InternalSettings.idl:
+
 2015-06-02  Matt Rajca  <mra...@apple.com>
 
         Added a stub implementation of MediaSession, part of the Media Session spec.

Modified: trunk/Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp (185127 => 185128)


--- trunk/Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp	2015-06-02 22:02:35 UTC (rev 185127)
+++ trunk/Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp	2015-06-02 22:11:32 UTC (rev 185128)
@@ -362,9 +362,11 @@
     bool isPendingPolicyResolution = false;
     Document& topDocument = document.topDocument();
     Page* page = topDocument.page();
-    if (page && !topDocument.url().isLocalFile()) {
-        WebGLLoadPolicy policy = page->mainFrame().loader().client().webGLPolicyForURL(topDocument.url());
+    bool forcingPendingPolicy = frame->settings().isForcePendingWebGLPolicy();
 
+    if (forcingPendingPolicy || (page && !topDocument.url().isLocalFile())) {
+        WebGLLoadPolicy policy = forcingPendingPolicy ? WebGLPendingCreation : page->mainFrame().loader().client().webGLPolicyForURL(topDocument.url());
+
         if (policy == WebGLBlockCreation) {
             LOG(WebGL, "The policy for this URL (%s) is to block WebGL.", topDocument.url().host().utf8().data());
             return nullptr;
@@ -779,11 +781,17 @@
 
 int WebGLRenderingContextBase::drawingBufferWidth() const
 {
+    if (m_isPendingPolicyResolution && !m_hasRequestedPolicyResolution)
+        return 0;
+
     return m_context->getInternalFramebufferSize().width();
 }
 
 int WebGLRenderingContextBase::drawingBufferHeight() const
 {
+    if (m_isPendingPolicyResolution && !m_hasRequestedPolicyResolution)
+        return 0;
+
     return m_context->getInternalFramebufferSize().height();
 }
 

Modified: trunk/Source/WebCore/page/Settings.cpp (185127 => 185128)


--- trunk/Source/WebCore/page/Settings.cpp	2015-06-02 22:02:35 UTC (rev 185127)
+++ trunk/Source/WebCore/page/Settings.cpp	2015-06-02 22:11:32 UTC (rev 185128)
@@ -201,6 +201,7 @@
 #endif
     , m_hiddenPageCSSAnimationSuspensionEnabled(false)
     , m_fontFallbackPrefersPictographs(false)
+    , m_forcePendingWebGLPolicy(false)
 {
     // A Frame may not have been created yet, so we initialize the AtomicString
     // hash before trying to use it.
@@ -424,6 +425,11 @@
     m_setImageLoadingSettingsTimer.startOneShot(0);
 }
 
+void Settings::setForcePendingWebGLPolicy(bool forced)
+{
+    m_forcePendingWebGLPolicy = forced;
+}
+
 void Settings::setPluginsEnabled(bool arePluginsEnabled)
 {
     if (m_arePluginsEnabled == arePluginsEnabled)

Modified: trunk/Source/WebCore/page/Settings.h (185127 => 185128)


--- trunk/Source/WebCore/page/Settings.h	2015-06-02 22:02:35 UTC (rev 185127)
+++ trunk/Source/WebCore/page/Settings.h	2015-06-02 22:11:32 UTC (rev 185128)
@@ -270,6 +270,9 @@
     const String& mediaKeysStorageDirectory() const { return m_mediaKeysStorageDirectory; }
 #endif
 
+    WEBCORE_EXPORT void setForcePendingWebGLPolicy(bool);
+    bool isForcePendingWebGLPolicy() const { return m_forcePendingWebGLPolicy; }
+
 private:
     explicit Settings(Page*);
 
@@ -323,6 +326,8 @@
     bool m_hiddenPageCSSAnimationSuspensionEnabled : 1;
     bool m_fontFallbackPrefersPictographs : 1;
 
+    bool m_forcePendingWebGLPolicy : 1;
+
 #if USE(AVFOUNDATION)
     WEBCORE_EXPORT static bool gAVFoundationEnabled;
 #endif

Modified: trunk/Source/WebCore/testing/InternalSettings.cpp (185127 => 185128)


--- trunk/Source/WebCore/testing/InternalSettings.cpp	2015-06-02 22:02:35 UTC (rev 185127)
+++ trunk/Source/WebCore/testing/InternalSettings.cpp	2015-06-02 22:11:32 UTC (rev 185128)
@@ -85,6 +85,7 @@
     , m_shouldDisplayTextDescriptions(settings.shouldDisplayTextDescriptions())
 #endif
     , m_defaultVideoPosterURL(settings.defaultVideoPosterURL())
+    , m_forcePendingWebGLPolicy(settings.isForcePendingWebGLPolicy())
     , m_originalTimeWithoutMouseMovementBeforeHidingControls(settings.timeWithoutMouseMovementBeforeHidingControls())
     , m_useLegacyBackgroundSizeShorthandBehavior(settings.useLegacyBackgroundSizeShorthandBehavior())
     , m_autoscrollForDragAndDropEnabled(settings.autoscrollForDragAndDropEnabled())
@@ -152,6 +153,7 @@
     settings.setShouldDisplayTextDescriptions(m_shouldDisplayTextDescriptions);
 #endif
     settings.setDefaultVideoPosterURL(m_defaultVideoPosterURL);
+    settings.setForcePendingWebGLPolicy(m_forcePendingWebGLPolicy);
     settings.setTimeWithoutMouseMovementBeforeHidingControls(m_originalTimeWithoutMouseMovementBeforeHidingControls);
     settings.setUseLegacyBackgroundSizeShorthandBehavior(m_useLegacyBackgroundSizeShorthandBehavior);
     settings.setAutoscrollForDragAndDropEnabled(m_autoscrollForDragAndDropEnabled);
@@ -210,6 +212,7 @@
 {
     page()->setPageScaleFactor(1, IntPoint(0, 0));
     page()->setCanStartMedia(true);
+    page()->settings().setForcePendingWebGLPolicy(false);
 #if ENABLE(WIRELESS_PLAYBACK_TARGET)
     m_page->settings().setAllowsAirPlayForMediaPlayback(false);
 #endif
@@ -468,6 +471,12 @@
     settings()->setDefaultVideoPosterURL(url);
 }
 
+void InternalSettings::setForcePendingWebGLPolicy(bool forced, ExceptionCode& ec)
+{
+    InternalSettingsGuardForSettings();
+    settings()->setForcePendingWebGLPolicy(forced);
+}
+
 void InternalSettings::setTimeWithoutMouseMovementBeforeHidingControls(double time, ExceptionCode& ec)
 {
     InternalSettingsGuardForSettings();

Modified: trunk/Source/WebCore/testing/InternalSettings.h (185127 => 185128)


--- trunk/Source/WebCore/testing/InternalSettings.h	2015-06-02 22:02:35 UTC (rev 185127)
+++ trunk/Source/WebCore/testing/InternalSettings.h	2015-06-02 22:11:32 UTC (rev 185128)
@@ -83,6 +83,7 @@
         bool m_shouldDisplayTextDescriptions;
 #endif
         String m_defaultVideoPosterURL;
+        bool m_forcePendingWebGLPolicy;
         bool m_originalTimeWithoutMouseMovementBeforeHidingControls;
         bool m_useLegacyBackgroundSizeShorthandBehavior;
         bool m_autoscrollForDragAndDropEnabled;
@@ -134,6 +135,7 @@
     void setImagesEnabled(bool, ExceptionCode&);
     void setMinimumTimerInterval(double intervalInSeconds, ExceptionCode&);
     void setDefaultVideoPosterURL(const String& url, ExceptionCode&);
+    void setForcePendingWebGLPolicy(bool, ExceptionCode&);
     void setTimeWithoutMouseMovementBeforeHidingControls(double time, ExceptionCode&);
     void setUseLegacyBackgroundSizeShorthandBehavior(bool, ExceptionCode&);
     void setAutoscrollForDragAndDropEnabled(bool, ExceptionCode&);

Modified: trunk/Source/WebCore/testing/InternalSettings.idl (185127 => 185128)


--- trunk/Source/WebCore/testing/InternalSettings.idl	2015-06-02 22:02:35 UTC (rev 185127)
+++ trunk/Source/WebCore/testing/InternalSettings.idl	2015-06-02 22:11:32 UTC (rev 185128)
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2012 Google Inc. All rights reserved.
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -55,6 +56,8 @@
     [RaisesException] void setMediaTypeOverride(DOMString mediaTypeOverride);
     void setWirelessPlaybackDisabled(boolean available);
 
+    [RaisesException] void setForcePendingWebGLPolicy(boolean forced);
+
     void setPluginReplacementEnabled(boolean enabled);
 
     // Editing, forms
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to