2010-07-02 Zhenyao Mo <zmo@google.com>

        Reviewed by Dimitri Glazkov.

        Need to validate the size of the incoming arrays for uniform* functions
        https://bugs.webkit.org/show_bug.cgi?id=41383

        * fast/canvas/webgl/gl-uniform-arrays-expected.txt: Test against invalid array size.
        * fast/canvas/webgl/gl-uniform-arrays.html: Ditto.
        * fast/canvas/webgl/gl-uniformmatrix4fv-expected.txt: Ditto.
        * fast/canvas/webgl/gl-uniformmatrix4fv.html: Ditto.
2010-07-02  Zhenyao Mo  <zmo@google.com>

        Reviewed by Dimitri Glazkov.

        Need to validate the size of the incoming arrays for uniform* functions
        https://bugs.webkit.org/show_bug.cgi?id=41383

        * html/canvas/WebGLRenderingContext.cpp: Validate input array size.
        (WebCore::WebGLRenderingContext::uniform1fv):
        (WebCore::WebGLRenderingContext::uniform1iv):
        (WebCore::WebGLRenderingContext::uniform2fv):
        (WebCore::WebGLRenderingContext::uniform2iv):
        (WebCore::WebGLRenderingContext::uniform3fv):
        (WebCore::WebGLRenderingContext::uniform3iv):
        (WebCore::WebGLRenderingContext::uniform4fv):
        (WebCore::WebGLRenderingContext::uniform4iv):
        (WebCore::WebGLRenderingContext::uniformMatrix2fv):
        (WebCore::WebGLRenderingContext::uniformMatrix3fv):
        (WebCore::WebGLRenderingContext::uniformMatrix4fv):
        (WebCore::WebGLRenderingContext::validateUniformParameters):
        (WebCore::WebGLRenderingContext::validateUniformMatrixParameters):
        * html/canvas/WebGLRenderingContext.h: Add helper functions.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@62384 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 1a411f3dc41e7fe9589d87c9580fc5985505e2f4..c82b96adb62f8c82e26c47a62c378d43944b2a82 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,15 @@
+2010-07-02  Zhenyao Mo  <zmo@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Need to validate the size of the incoming arrays for uniform* functions
+        https://bugs.webkit.org/show_bug.cgi?id=41383
+
+        * fast/canvas/webgl/gl-uniform-arrays-expected.txt: Test against invalid array size.
+        * fast/canvas/webgl/gl-uniform-arrays.html: Ditto.
+        * fast/canvas/webgl/gl-uniformmatrix4fv-expected.txt: Ditto.
+        * fast/canvas/webgl/gl-uniformmatrix4fv.html: Ditto.
+
 2010-07-02  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
 
         Reviewed by Simon Hausmann.

diff --git a/LayoutTests/fast/canvas/webgl/gl-uniform-arrays-expected.txt b/LayoutTests/fast/canvas/webgl/gl-uniform-arrays-expected.txt
index 9c5b7bace821ffb7364ce5c46e22c980a8ca8655..1ccbd5e1bbecc37ea2a5fa0e6a9fa7bedcef922e 100644 (file)
--- a/LayoutTests/fast/canvas/webgl/gl-uniform-arrays-expected.txt
+++ b/LayoutTests/fast/canvas/webgl/gl-uniform-arrays-expected.txt
@@ -8,6 +8,7 @@ check float
 PASS 1 uniform found
 PASS uniform name is 'color[0]' not 'color' as per OpenGL ES 2.0.24 section 2.10
 PASS should fail if there is no current program
+PASS should fail with insufficient array size with gl.uniform1fv
 PASS can set an array of uniforms with gl.uniform1fv
 PASS can call gl.getUniform
 PASS gl.getUniform returns the correct type.
@@ -27,6 +28,7 @@ check vec2
 PASS 1 uniform found
 PASS uniform name is 'color[0]' not 'color' as per OpenGL ES 2.0.24 section 2.10
 PASS should fail if there is no current program
+PASS should fail with insufficient array size with gl.uniform2fv
 PASS can set an array of uniforms with gl.uniform2fv
 PASS can call gl.getUniform
 PASS gl.getUniform returns the correct type.
@@ -46,6 +48,7 @@ check vec3
 PASS 1 uniform found
 PASS uniform name is 'color[0]' not 'color' as per OpenGL ES 2.0.24 section 2.10
 PASS should fail if there is no current program
+PASS should fail with insufficient array size with gl.uniform3fv
 PASS can set an array of uniforms with gl.uniform3fv
 PASS can call gl.getUniform
 PASS gl.getUniform returns the correct type.
@@ -57,7 +60,7 @@ PASS can get value of element 1 of array from gl.getUniform
 PASS value put in ([13, 12, 11]) matches value pulled out ([13, 12, 11])
 PASS can get location of element 2 of array from gl.getUniformLocation
 PASS can get value of element 2 of array from gl.getUniform
-PASS value put in ([10, 11, 9]) matches value pulled out ([10, 11, 9])
+PASS value put in ([10, 9, 8]) matches value pulled out ([10, 9, 8])
 PASS using the wrong size of gl.Uniform fails
 PASS can call gl.useProgram(null)
 
@@ -65,6 +68,7 @@ check vec4
 PASS 1 uniform found
 PASS uniform name is 'color[0]' not 'color' as per OpenGL ES 2.0.24 section 2.10
 PASS should fail if there is no current program
+PASS should fail with insufficient array size with gl.uniform4fv
 PASS can set an array of uniforms with gl.uniform4fv
 PASS can call gl.getUniform
 PASS gl.getUniform returns the correct type.
@@ -73,10 +77,10 @@ PASS can get value of element 0 of array from gl.getUniform
 PASS value put in ([16, 15, 14, 13]) matches value pulled out ([16, 15, 14, 13])
 PASS can get location of element 1 of array from gl.getUniformLocation
 PASS can get value of element 1 of array from gl.getUniform
-PASS value put in ([12, 11, 10, 11]) matches value pulled out ([12, 11, 10, 11])
+PASS value put in ([12, 11, 10, 9]) matches value pulled out ([12, 11, 10, 9])
 PASS can get location of element 2 of array from gl.getUniformLocation
 PASS can get value of element 2 of array from gl.getUniform
-PASS value put in ([9, 8, 7, 6]) matches value pulled out ([9, 8, 7, 6])
+PASS value put in ([8, 7, 6, 5]) matches value pulled out ([8, 7, 6, 5])
 PASS using the wrong size of gl.Uniform fails
 PASS can call gl.useProgram(null)
 

diff --git a/LayoutTests/fast/canvas/webgl/gl-uniform-arrays.html b/LayoutTests/fast/canvas/webgl/gl-uniform-arrays.html
index 2e8ccbedf93d24dbbc4c8b9744d9777593b20777..0ee7b3eb200fd922f483c071431fe6e054ea1824 100644 (file)
--- a/LayoutTests/fast/canvas/webgl/gl-uniform-arrays.html
+++ b/LayoutTests/fast/canvas/webgl/gl-uniform-arrays.html
@@ -105,7 +105,8 @@ var typeInfos = [
     checkValue: function(typeInfo, index, value) {
       return typeInfo.srcValues[index] == value;
     },
-    srcValues: [16, 15, 14]
+    srcValues: [16, 15, 14],
+    srcValuesBad: [],
   },
   { type: 'vec2',
     jsTypeOf: 'Float32Array',
@@ -132,6 +133,7 @@ var typeInfos = [
              typeInfo.srcValues[index * 2 + 1] == value[1];
     },
     srcValues: [16, 15, 14, 13, 12, 11],
+    srcValuesBad: [16],
   },
   { type: 'vec3',
     jsTypeOf: 'Float32Array',
@@ -160,7 +162,8 @@ var typeInfos = [
              typeInfo.srcValues[index * 3 + 1] == value[1] &&
              typeInfo.srcValues[index * 3 + 2] == value[2];
     },
-    srcValues: [16, 15, 14, 13, 12, 11, 10, 11, 9],
+    srcValues: [16, 15, 14, 13, 12, 11, 10, 9, 8],
+    srcValuesBad: [16, 15],
   },
   { type: 'vec4',
     jsTypeOf: 'Float32Array',
@@ -192,7 +195,8 @@ var typeInfos = [
              typeInfo.srcValues[index * 4 + 2] == value[2] &&
              typeInfo.srcValues[index * 4 + 3] == value[3];
     },
-    srcValues: [16, 15, 14, 13, 12, 11, 10, 11, 9, 8, 7, 6, 5],
+    srcValues: [16, 15, 14, 13, 12, 11, 10, 9, 8, 7, 6, 5],
+    srcValuesBad: [16, 15, 14],
   }
 ];
 
@@ -212,6 +216,7 @@ for (var tt = 0; tt < typeInfos.length; ++tt) {
             "uniform name is 'color[0]' not 'color' as per OpenGL ES 2.0.24 section 2.10");
   var loc = gl.getUniformLocation(program, "color");
   var srcValues = typeInfo.srcValues;
+  var srcValuesBad = typeInfo.srcValuesBad;
 
   // Try setting the value before using the program
   gl[typeInfo.setter](loc, srcValues);
@@ -219,6 +224,9 @@ for (var tt = 0; tt < typeInfos.length; ++tt) {
             "should fail if there is no current program");
 
   gl.useProgram(program);
+  gl[typeInfo.setter](loc, srcValuesBad);
+  assertMsg(gl.getError() == gl.INVALID_VALUE,
+            "should fail with insufficient array size with gl." + typeInfo.setter);
   gl[typeInfo.setter](loc, srcValues);
   assertMsg(gl.getError() == gl.NO_ERROR,
             "can set an array of uniforms with gl." + typeInfo.setter);

diff --git a/LayoutTests/fast/canvas/webgl/gl-uniformmatrix4fv-expected.txt b/LayoutTests/fast/canvas/webgl/gl-uniformmatrix4fv-expected.txt
index 138369dd507f8dfe0ab300dbcf39477cc8aa9ec3..03ff5c4eb5e0def18f153a096a83b65bf06784b0 100644 (file)
--- a/LayoutTests/fast/canvas/webgl/gl-uniformmatrix4fv-expected.txt
+++ b/LayoutTests/fast/canvas/webgl/gl-uniformmatrix4fv-expected.txt
@@ -4,10 +4,13 @@ On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE
 
 
 Checking gl.uniformMatrix.
+PASS should fail with insufficient array size for uniformMatrix2fv
 PASS can call uniformMatrix2fvwith transpose = false
 PASS uniformMatrix2fv should return INVALID_VALUE with transpose = true
+PASS should fail with insufficient array size for uniformMatrix3fv
 PASS can call uniformMatrix3fvwith transpose = false
 PASS uniformMatrix3fv should return INVALID_VALUE with transpose = true
+PASS should fail with insufficient array size for uniformMatrix4fv
 PASS can call uniformMatrix4fvwith transpose = false
 PASS uniformMatrix4fv should return INVALID_VALUE with transpose = true
 

diff --git a/LayoutTests/fast/canvas/webgl/gl-uniformmatrix4fv.html b/LayoutTests/fast/canvas/webgl/gl-uniformmatrix4fv.html
index 991996f608fd5789edb6e441b71710b2adf209ec..4c5c98da7600b8043f5d5fef58151107c26bb3aa 100644 (file)
--- a/LayoutTests/fast/canvas/webgl/gl-uniformmatrix4fv.html
+++ b/LayoutTests/fast/canvas/webgl/gl-uniformmatrix4fv.html
@@ -44,11 +44,16 @@ for (var ii = 2; ii <= 4; ++ii) {
   var mat = [];
   for (var jj = 0; jj < ii; ++jj) {
     for (var ll = 0; ll < ii; ++ll) {
+      if (jj == ii -1 && ll == ii - 1)
+        continue;
       mat[jj * ii + ll] = (jj == ll) ? 1 : 0;
     }
   }
   name = "uniformMatrix" + ii + "fv";
   gl[name](loc, false, mat);
+  assertMsg(gl.getError() == gl.INVALID_VALUE, "should fail with insufficient array size for " + name);
+  mat[ii * ii - 1] = 1;
+  gl[name](loc, false, mat);
   assertMsg(gl.getError() == gl.NO_ERROR, "can call " + name + "with transpose = false");
   gl[name](loc, true, mat);
   assertMsg(gl.getError() == gl.INVALID_VALUE, name + " should return INVALID_VALUE with transpose = true");

diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 80c4b8bf4c6da4ac7d3645d331cba178ac3fa0fd..b9accc9eeed5310a8fb26c46aa6cc14e209f9abb 100644 (file)
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,26 @@
+2010-07-02  Zhenyao Mo  <zmo@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Need to validate the size of the incoming arrays for uniform* functions
+        https://bugs.webkit.org/show_bug.cgi?id=41383
+
+        * html/canvas/WebGLRenderingContext.cpp: Validate input array size.
+        (WebCore::WebGLRenderingContext::uniform1fv):
+        (WebCore::WebGLRenderingContext::uniform1iv):
+        (WebCore::WebGLRenderingContext::uniform2fv):
+        (WebCore::WebGLRenderingContext::uniform2iv):
+        (WebCore::WebGLRenderingContext::uniform3fv):
+        (WebCore::WebGLRenderingContext::uniform3iv):
+        (WebCore::WebGLRenderingContext::uniform4fv):
+        (WebCore::WebGLRenderingContext::uniform4iv):
+        (WebCore::WebGLRenderingContext::uniformMatrix2fv):
+        (WebCore::WebGLRenderingContext::uniformMatrix3fv):
+        (WebCore::WebGLRenderingContext::uniformMatrix4fv):
+        (WebCore::WebGLRenderingContext::validateUniformParameters):
+        (WebCore::WebGLRenderingContext::validateUniformMatrixParameters):
+        * html/canvas/WebGLRenderingContext.h: Add helper functions.
+
 2010-07-02  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
 
         Reviewed by Simon Hausmann.

diff --git a/WebCore/html/canvas/WebGLRenderingContext.cpp b/WebCore/html/canvas/WebGLRenderingContext.cpp
index 3afee9dd7dd71d4fa7ec30f7c1e27ca8f52bf655..7af65055e64a7ce948cba18cf878f0981c622bb7 100644 (file)
--- a/WebCore/html/canvas/WebGLRenderingContext.cpp
+++ b/WebCore/html/canvas/WebGLRenderingContext.cpp
@@ -2498,18 +2498,9 @@ void WebGLRenderingContext::uniform1f(const WebGLUniformLocation* location, floa
 void WebGLRenderingContext::uniform1fv(const WebGLUniformLocation* location, Float32Array* v, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if (!location)
-        return;
-
-    if (location->program() != m_currentProgram) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+    if (!validateUniformParameters(location, v, 1))
         return;
-    }
 
-    if (!v) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
-        return;
-    }
     m_context->uniform1fv(location->location(), v->data(), v->length());
     cleanupAfterGraphicsCall(false);
 }
@@ -2517,18 +2508,9 @@ void WebGLRenderingContext::uniform1fv(const WebGLUniformLocation* location, Flo
 void WebGLRenderingContext::uniform1fv(const WebGLUniformLocation* location, float* v, int size, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if (!location)
-        return;
-
-    if (location->program() != m_currentProgram) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+    if (!validateUniformParameters(location, v, size, 1))
         return;
-    }
 
-    if (!v) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
-        return;
-    }
     m_context->uniform1fv(location->location(), v, size);
     cleanupAfterGraphicsCall(false);
 }
@@ -2551,18 +2533,9 @@ void WebGLRenderingContext::uniform1i(const WebGLUniformLocation* location, int
 void WebGLRenderingContext::uniform1iv(const WebGLUniformLocation* location, Int32Array* v, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if (!location)
+    if (!validateUniformParameters(location, v, 1))
         return;
 
-    if (location->program() != m_currentProgram) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
-        return;
-    }
-
-    if (!v) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
-        return;
-    }
     m_context->uniform1iv(location->location(), v->data(), v->length());
     cleanupAfterGraphicsCall(false);
 }
@@ -2570,18 +2543,9 @@ void WebGLRenderingContext::uniform1iv(const WebGLUniformLocation* location, Int
 void WebGLRenderingContext::uniform1iv(const WebGLUniformLocation* location, int* v, int size, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if (!location)
-        return;
-
-    if (location->program() != m_currentProgram) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+    if (!validateUniformParameters(location, v, size, 1))
         return;
-    }
 
-    if (!v) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
-        return;
-    }
     m_context->uniform1iv(location->location(), v, size);
     cleanupAfterGraphicsCall(false);
 }
@@ -2604,19 +2568,9 @@ void WebGLRenderingContext::uniform2f(const WebGLUniformLocation* location, floa
 void WebGLRenderingContext::uniform2fv(const WebGLUniformLocation* location, Float32Array* v, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if (!location)
+    if (!validateUniformParameters(location, v, 2))
         return;
 
-    if (location->program() != m_currentProgram) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
-        return;
-    }
-
-    if (!v) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
-        return;
-    }
-    // FIXME: length needs to be a multiple of 2
     m_context->uniform2fv(location->location(), v->data(), v->length() / 2);
     cleanupAfterGraphicsCall(false);
 }
@@ -2624,19 +2578,9 @@ void WebGLRenderingContext::uniform2fv(const WebGLUniformLocation* location, Flo
 void WebGLRenderingContext::uniform2fv(const WebGLUniformLocation* location, float* v, int size, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if (!location)
-        return;
-
-    if (location->program() != m_currentProgram) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+    if (!validateUniformParameters(location, v, size, 2))
         return;
-    }
 
-    if (!v) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
-        return;
-    }
-    // FIXME: length needs to be a multiple of 2
     m_context->uniform2fv(location->location(), v, size / 2);
     cleanupAfterGraphicsCall(false);
 }
@@ -2659,19 +2603,9 @@ void WebGLRenderingContext::uniform2i(const WebGLUniformLocation* location, int
 void WebGLRenderingContext::uniform2iv(const WebGLUniformLocation* location, Int32Array* v, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if (!location)
-        return;
-
-    if (location->program() != m_currentProgram) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+    if (!validateUniformParameters(location, v, 2))
         return;
-    }
 
-    if (!v) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
-        return;
-    }
-    // FIXME: length needs to be a multiple of 2
     m_context->uniform2iv(location->location(), v->data(), v->length() / 2);
     cleanupAfterGraphicsCall(false);
 }
@@ -2679,19 +2613,9 @@ void WebGLRenderingContext::uniform2iv(const WebGLUniformLocation* location, Int
 void WebGLRenderingContext::uniform2iv(const WebGLUniformLocation* location, int* v, int size, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if (!location)
+    if (!validateUniformParameters(location, v, size, 2))
         return;
 
-    if (location->program() != m_currentProgram) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
-        return;
-    }
-
-    if (!v) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
-        return;
-    }
-    // FIXME: length needs to be a multiple of 2
     m_context->uniform2iv(location->location(), v, size / 2);
     cleanupAfterGraphicsCall(false);
 }
@@ -2714,19 +2638,9 @@ void WebGLRenderingContext::uniform3f(const WebGLUniformLocation* location, floa
 void WebGLRenderingContext::uniform3fv(const WebGLUniformLocation* location, Float32Array* v, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if (!location)
+    if (!validateUniformParameters(location, v, 3))
         return;
 
-    if (location->program() != m_currentProgram) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
-        return;
-    }
-
-    if (!v) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
-        return;
-    }
-    // FIXME: length needs to be a multiple of 3
     m_context->uniform3fv(location->location(), v->data(), v->length() / 3);
     cleanupAfterGraphicsCall(false);
 }
@@ -2734,19 +2648,9 @@ void WebGLRenderingContext::uniform3fv(const WebGLUniformLocation* location, Flo
 void WebGLRenderingContext::uniform3fv(const WebGLUniformLocation* location, float* v, int size, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if (!location)
+    if (!validateUniformParameters(location, v, size, 3))
         return;
 
-    if (location->program() != m_currentProgram) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
-        return;
-    }
-
-    if (!v) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
-        return;
-    }
-    // FIXME: length needs to be a multiple of 3
     m_context->uniform3fv(location->location(), v, size / 3);
     cleanupAfterGraphicsCall(false);
 }
@@ -2769,19 +2673,9 @@ void WebGLRenderingContext::uniform3i(const WebGLUniformLocation* location, int
 void WebGLRenderingContext::uniform3iv(const WebGLUniformLocation* location, Int32Array* v, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if (!location)
-        return;
-
-    if (location->program() != m_currentProgram) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+    if (!validateUniformParameters(location, v, 3))
         return;
-    }
 
-    if (!v) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
-        return;
-    }
-    // FIXME: length needs to be a multiple of 3
     m_context->uniform3iv(location->location(), v->data(), v->length() / 3);
     cleanupAfterGraphicsCall(false);
 }
@@ -2789,19 +2683,9 @@ void WebGLRenderingContext::uniform3iv(const WebGLUniformLocation* location, Int
 void WebGLRenderingContext::uniform3iv(const WebGLUniformLocation* location, int* v, int size, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if (!location)
-        return;
-
-    if (location->program() != m_currentProgram) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+    if (!validateUniformParameters(location, v, size, 3))
         return;
-    }
 
-    if (!v) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
-        return;
-    }
-    // FIXME: length needs to be a multiple of 3
     m_context->uniform3iv(location->location(), v, size / 3);
     cleanupAfterGraphicsCall(false);
 }
@@ -2824,19 +2708,9 @@ void WebGLRenderingContext::uniform4f(const WebGLUniformLocation* location, floa
 void WebGLRenderingContext::uniform4fv(const WebGLUniformLocation* location, Float32Array* v, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if (!location)
-        return;
-
-    if (location->program() != m_currentProgram) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+    if (!validateUniformParameters(location, v, 4))
         return;
-    }
 
-    if (!v) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
-        return;
-    }
-    // FIXME: length needs to be a multiple of 4
     m_context->uniform4fv(location->location(), v->data(), v->length() / 4);
     cleanupAfterGraphicsCall(false);
 }
@@ -2844,19 +2718,9 @@ void WebGLRenderingContext::uniform4fv(const WebGLUniformLocation* location, Flo
 void WebGLRenderingContext::uniform4fv(const WebGLUniformLocation* location, float* v, int size, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if (!location)
-        return;
-
-    if (location->program() != m_currentProgram) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+    if (!validateUniformParameters(location, v, size, 4))
         return;
-    }
 
-    if (!v) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
-        return;
-    }
-    // FIXME: length needs to be a multiple of 4
     m_context->uniform4fv(location->location(), v, size / 4);
     cleanupAfterGraphicsCall(false);
 }
@@ -2879,19 +2743,9 @@ void WebGLRenderingContext::uniform4i(const WebGLUniformLocation* location, int
 void WebGLRenderingContext::uniform4iv(const WebGLUniformLocation* location, Int32Array* v, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if (!location)
+    if (!validateUniformParameters(location, v, 4))
         return;
 
-    if (location->program() != m_currentProgram) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
-        return;
-    }
-
-    if (!v) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
-        return;
-    }
-    // FIXME: length needs to be a multiple of 4
     m_context->uniform4iv(location->location(), v->data(), v->length() / 4);
     cleanupAfterGraphicsCall(false);
 }
@@ -2899,19 +2753,9 @@ void WebGLRenderingContext::uniform4iv(const WebGLUniformLocation* location, Int
 void WebGLRenderingContext::uniform4iv(const WebGLUniformLocation* location, int* v, int size, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if (!location)
+    if (!validateUniformParameters(location, v, size, 4))
         return;
 
-    if (location->program() != m_currentProgram) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
-        return;
-    }
-
-    if (!v) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
-        return;
-    }
-    // FIXME: length needs to be a multiple of 4
     m_context->uniform4iv(location->location(), v, size / 4);
     cleanupAfterGraphicsCall(false);
 }
@@ -2919,9 +2763,8 @@ void WebGLRenderingContext::uniform4iv(const WebGLUniformLocation* location, int
 void WebGLRenderingContext::uniformMatrix2fv(const WebGLUniformLocation* location, bool transpose, Float32Array* v, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if (!validateUniformMatrixParameters(location, transpose, v))
+    if (!validateUniformMatrixParameters(location, transpose, v, 4))
         return;
-    // FIXME: length needs to be a multiple of 4
     m_context->uniformMatrix2fv(location->location(), transpose, v->data(), v->length() / 4);
     cleanupAfterGraphicsCall(false);
 }
@@ -2929,9 +2772,8 @@ void WebGLRenderingContext::uniformMatrix2fv(const WebGLUniformLocation* locatio
 void WebGLRenderingContext::uniformMatrix2fv(const WebGLUniformLocation* location, bool transpose, float* v, int size, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if (!validateUniformMatrixParameters(location, transpose, v))
+    if (!validateUniformMatrixParameters(location, transpose, v, size, 4))
         return;
-    // FIXME: length needs to be a multiple of 4
     m_context->uniformMatrix2fv(location->location(), transpose, v, size / 4);
     cleanupAfterGraphicsCall(false);
 }
@@ -2939,9 +2781,8 @@ void WebGLRenderingContext::uniformMatrix2fv(const WebGLUniformLocation* locatio
 void WebGLRenderingContext::uniformMatrix3fv(const WebGLUniformLocation* location, bool transpose, Float32Array* v, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if (!validateUniformMatrixParameters(location, transpose, v))
+    if (!validateUniformMatrixParameters(location, transpose, v, 9))
         return;
-    // FIXME: length needs to be a multiple of 9
     m_context->uniformMatrix3fv(location->location(), transpose, v->data(), v->length() / 9);
     cleanupAfterGraphicsCall(false);
 }
@@ -2949,9 +2790,8 @@ void WebGLRenderingContext::uniformMatrix3fv(const WebGLUniformLocation* locatio
 void WebGLRenderingContext::uniformMatrix3fv(const WebGLUniformLocation* location, bool transpose, float* v, int size, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if (!validateUniformMatrixParameters(location, transpose, v))
+    if (!validateUniformMatrixParameters(location, transpose, v, size, 9))
         return;
-    // FIXME: length needs to be a multiple of 9
     m_context->uniformMatrix3fv(location->location(), transpose, v, size / 9);
     cleanupAfterGraphicsCall(false);
 }
@@ -2959,9 +2799,8 @@ void WebGLRenderingContext::uniformMatrix3fv(const WebGLUniformLocation* locatio
 void WebGLRenderingContext::uniformMatrix4fv(const WebGLUniformLocation* location, bool transpose, Float32Array* v, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if (!validateUniformMatrixParameters(location, transpose, v))
+    if (!validateUniformMatrixParameters(location, transpose, v, 16))
         return;
-    // FIXME: length needs to be a multiple of 16
     m_context->uniformMatrix4fv(location->location(), transpose, v->data(), v->length() / 16);
     cleanupAfterGraphicsCall(false);
 }
@@ -2969,9 +2808,8 @@ void WebGLRenderingContext::uniformMatrix4fv(const WebGLUniformLocation* locatio
 void WebGLRenderingContext::uniformMatrix4fv(const WebGLUniformLocation* location, bool transpose, float* v, int size, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if (!validateUniformMatrixParameters(location, transpose, v))
+    if (!validateUniformMatrixParameters(location, transpose, v, size, 16))
         return;
-    // FIXME: length needs to be a multiple of 16
     m_context->uniformMatrix4fv(location->location(), transpose, v, size / 16);
     cleanupAfterGraphicsCall(false);
 }
@@ -3626,7 +3464,39 @@ bool WebGLRenderingContext::validateCapability(unsigned long cap)
     }
 }
 
-bool WebGLRenderingContext::validateUniformMatrixParameters(const WebGLUniformLocation* location, bool transpose, void* v)
+bool WebGLRenderingContext::validateUniformParameters(const WebGLUniformLocation* location, Float32Array* v, int requiredMinSize)
+{
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return false;
+    }
+    return validateUniformMatrixParameters(location, false, v->data(), v->length(), requiredMinSize);
+}
+
+bool WebGLRenderingContext::validateUniformParameters(const WebGLUniformLocation* location, Int32Array* v, int requiredMinSize)
+{
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return false;
+    }
+    return validateUniformMatrixParameters(location, false, v->data(), v->length(), requiredMinSize);
+}
+
+bool WebGLRenderingContext::validateUniformParameters(const WebGLUniformLocation* location, void* v, int size, int requiredMinSize)
+{
+    return validateUniformMatrixParameters(location, false, v, size, requiredMinSize);
+}
+
+bool WebGLRenderingContext::validateUniformMatrixParameters(const WebGLUniformLocation* location, bool transpose, Float32Array* v, int requiredMinSize)
+{
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return false;
+    }
+    return validateUniformMatrixParameters(location, transpose, v->data(), v->length(), requiredMinSize);
+}
+
+bool WebGLRenderingContext::validateUniformMatrixParameters(const WebGLUniformLocation* location, bool transpose, void* v, int size, int requiredMinSize)
 {
     if (!location)
         return false;
@@ -3642,6 +3512,10 @@ bool WebGLRenderingContext::validateUniformMatrixParameters(const WebGLUniformLo
         m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
         return false;
     }
+    if (size < requiredMinSize) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return false;
+    }
     return true;
 }
 

diff --git a/WebCore/html/canvas/WebGLRenderingContext.h b/WebCore/html/canvas/WebGLRenderingContext.h
index f01a943cc01e7611c3fbbdebc7dbca7cdc4a52a2..93d1b9fbbd3ffd43c59cea963a14168e4462c2d8 100644 (file)
--- a/WebCore/html/canvas/WebGLRenderingContext.h
+++ b/WebCore/html/canvas/WebGLRenderingContext.h
@@ -466,8 +466,12 @@ class WebKitCSSMatrix;
         // Helper function to validate a GL capability.
         bool validateCapability(unsigned long);
 
-        // Helper function to validate input parameters for uniformMatrix functions.
-        bool validateUniformMatrixParameters(const WebGLUniformLocation* location, bool transpose, void* v);
+        // Helper function to validate input parameters for uniform functions.
+        bool validateUniformParameters(const WebGLUniformLocation* location, Float32Array* v, int mod);
+        bool validateUniformParameters(const WebGLUniformLocation* location, Int32Array* v, int mod);
+        bool validateUniformParameters(const WebGLUniformLocation* location, void* v, int size, int mod);
+        bool validateUniformMatrixParameters(const WebGLUniformLocation* location, bool transpose, Float32Array* v, int mod);
+        bool validateUniformMatrixParameters(const WebGLUniformLocation* location, bool transpose, void* v, int size, int mod);
 
         friend class WebGLStateRestorer;
     };