--- /dev/null
+<!DOCTYPE html>\r
+<html>\r
+<script id='2d-vertex-shader' type='x-shader/x-vertex'>\r
+ attribute vec4 a_Position; \r
+ void main() { gl_Position = a_Position; }\r
+</script>\r
+<script id='2d-fragment-shader' type='x-shader/x-fragment'>\r
+ void main( void ) {}\r
+</script>\r
+<body>\r
+<canvas id="canvas1" width="20" height="20"></canvas>\r
+<script>\r
+if (window.testRunner)\r
+ testRunner.dumpAsText();\r
+\r
+// Boilerplate set-up.\r
+let canvas = document.getElementById('canvas1');\r
+let gl = canvas.getContext('webgl');\r
+\r
+let vShader = gl.createShader(gl.VERTEX_SHADER);\r
+let vShaderScript = document.getElementById('2d-vertex-shader');\r
+gl.shaderSource(vShader, vShaderScript.text);\r
+gl.compileShader(vShader);\r
+\r
+let fShader = gl.createShader(gl.FRAGMENT_SHADER);\r
+let fShaderScript = document.getElementById('2d-fragment-shader');\r
+gl.shaderSource(fShader, fShaderScript.text);\r
+gl.compileShader(fShader);\r
+\r
+let program = gl.createProgram();\r
+gl.attachShader(program, vShader);\r
+gl.attachShader(program, fShader);\r
+gl.linkProgram(program);\r
+gl.useProgram(program);\r
+\r
+gl.getExtension("OES_element_index_uint");\r
+let ext = gl.getExtension('ANGLE_instanced_arrays');\r
+\r
+// Execute a draw that is valid, if strange.\r
+let buffer = gl.createBuffer();\r
+gl.bindBuffer(gl.ELEMENT_ARRAY_BUFFER, buffer);\r
+gl.bufferData(gl.ELEMENT_ARRAY_BUFFER, new Uint8ClampedArray([256, 256, 256, 256]), gl.STATIC_DRAW);\r
+ext.drawElementsInstancedANGLE(gl.TRIANGLES, 2, gl.UNSIGNED_SHORT, 0, gl.UNSIGNED_SHORT);\r
+\r
+// Execute a draw that is invalid because an element index is too large.\r
+buffer = gl.createBuffer();\r
+gl.bindBuffer(gl.ELEMENT_ARRAY_BUFFER, buffer);\r
+gl.bufferData(gl.ELEMENT_ARRAY_BUFFER, new Uint16Array([65536, 137413, 65536, 65536, 65536, 65536, 65536, 65536, 65536, 65536, 65536, 65536, 65536, 65536, 65536]), gl.STATIC_DRAW);\r
+gl.bufferSubData(gl.ELEMENT_ARRAY_BUFFER, 10, new Uint8ClampedArray([256, 256, 256, 256, 256, 256]));\r
+gl.drawElements(gl.TRIANGLES, 1, gl.UNSIGNED_INT, 0);\r
+\r
+// Now execute a similarly invalid call, that uses a smaller simulated buffer than the previous invalid call.\r
+buffer = gl.createBuffer();\r
+gl.bindBuffer(gl.ELEMENT_ARRAY_BUFFER, buffer);\r
+gl.bufferData(gl.ELEMENT_ARRAY_BUFFER, new Uint8ClampedArray([256, 256, 256, 256, 256, 256]), gl.STATIC_DRAW);\r
+gl.drawElements(gl.TRIANGLES, 1, gl.UNSIGNED_SHORT, 0);\r
+</script>\r
+</html>
\ No newline at end of file
+2018-05-06 Dean Jackson <dino@apple.com>
+
+ WebGL: Reset simulated values after validation fails
+ https://bugs.webkit.org/show_bug.cgi?id=185363
+ <rdar://problem/39733417>
+
+ Reviewed by Anders Carlsson.
+
+ While fixing a previous bug, I forgot to reset some values
+ when validation fails. This caused a bug where a subsequent
+ invalid call might use those values and escape detection.
+
+ Test: fast/canvas/webgl/index-validation-with-subsequent-draws.html
+
+ * html/canvas/WebGLRenderingContextBase.cpp:
+ (WebCore::WebGLRenderingContextBase::simulateVertexAttrib0): Reset the
+ sizes when validation fails.
+ * html/canvas/WebGLRenderingContextBase.h:
+
2018-05-07 Ms2ger <Ms2ger@igalia.com>
Support negative sw/sh values in createImageBitmap().