Issue #9097: Don't panic when calling *VertexAttrib* with invalid ind…

…ices.
servo · simartin · Dec 30, 2015 · Dec 30, 2015 · b9531f4d617c63928ee346072062691f38b174c3
commit b9531f4d617c63928ee346072062691f38b174c3
diff --git a/components/canvas/webgl_paint_task.rs b/components/canvas/webgl_paint_task.rs
@@ -50,6 +50,20 @@ impl WebGLPaintTask {
     /// NB: Not gl-related validations (names, lengths, accepted parameters...) are
     /// done in the corresponding DOM interfaces
     pub fn handle_webgl_message(&self, message: CanvasWebGLMsg) {
+        match message {
+            // *VertexAttrib* generate a GL_INVALID_VALUE error if called with an index above
+            // GL_MAX_VERTEX_ATTRIBS, so leave early in that case (see for instance
+            // https://www.khronos.org/opengles/sdk/docs/man/xhtml/glVertexAttrib.xml)
+            CanvasWebGLMsg::EnableVertexAttribArray(attrib_id) |
+            CanvasWebGLMsg::VertexAttrib(attrib_id, _, _, _, _) |
+            CanvasWebGLMsg::VertexAttribPointer2f(attrib_id, _, _, _, _) => {
+                if attrib_id >= gl::get_integer_v(gl::MAX_VERTEX_ATTRIBS) as u32 {
+                    return
+                }
+            },
+            _ => ()
+        }
+
         match message {
             CanvasWebGLMsg::GetContextAttributes(sender) =>
                 self.context_attributes(sender),

diff --git a/tests/wpt/mozilla/meta/MANIFEST.json b/tests/wpt/mozilla/meta/MANIFEST.json
@@ -5877,6 +5877,12 @@
             "url": "/_mozilla/mozilla/webgl/get_supported_extensions.html"
           }
         ],
+        "mozilla/webgl/vertex_attrib_above_limit.html": [
+          {
+            "path": "mozilla/webgl/vertex_attrib_above_limit.html",
+            "url": "/_mozilla/mozilla/webgl/vertex_attrib_above_limit.html"
+          }
+        ],
         "mozilla/websocket_connection_fail.html": [
           {
             "path": "mozilla/websocket_connection_fail.html",

diff --git a/tests/wpt/mozilla/tests/mozilla/webgl/vertex_attrib_above_limit.html b/tests/wpt/mozilla/tests/mozilla/webgl/vertex_attrib_above_limit.html
@@ -0,0 +1,67 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>Issue #9097: Don't panic calling *VertexAttrib* API with out-of-bounds indices</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<html>
+  <head>
+    <script id="shader-fs" type="x-shader/x-fragment">
+      precision mediump float;
+      void main(void) {}
+    </script>
+    <script id="shader-vs" type="x-shader/x-vertex">
+      attribute vec3 aVertexPosition;
+      void main(void) {}
+    </script>
+    <script type="application/x-javascript">
+      var gl;
+      function getShader(gl, id) {
+          var shaderScript = document.getElementById(id);
+          if (!shaderScript)
+              return null;
+          var shader;
+          if (shaderScript.type == "x-shader/x-fragment") {
+              shader = gl.createShader(gl.FRAGMENT_SHADER);
+          } else if (shaderScript.type == "x-shader/x-vertex") {
+              shader = gl.createShader(gl.VERTEX_SHADER);
+          }
+          gl.shaderSource(shader, shaderScript.textContent);
+          gl.compileShader(shader);
+          return shader;
+      }
+      var aVertexPosition;
+      function initBuffers() {
+        vertexPositionBuffer = gl.createBuffer();
+        gl.bindBuffer(gl.ARRAY_BUFFER, vertexPositionBuffer);
+        var vertices = [ 1.0,  1.0, -1.0,  1.0, 1.0, -1.0, -1.0, -1.0 ];
+        gl.bufferData(gl.ARRAY_BUFFER, new Float32Array(vertices), gl.STATIC_DRAW);
+        gl.vertexAttribPointer(aVertexPosition, 2, gl.FLOAT, false, 0, 0);
+      }
+      var canvas;
+      function webGLStart() {
+        canvas = document.getElementById("canvas");
+        gl = canvas.getContext("experimental-webgl");
+        var shaderProgram = gl.createProgram();
+        var vertexShader = getShader(gl, "shader-vs");
+        gl.attachShader(shaderProgram, vertexShader);
+        var fragmentShader = getShader(gl, "shader-fs");
+        gl.attachShader(shaderProgram, fragmentShader);
+        gl.linkProgram(shaderProgram);
+        gl.useProgram(shaderProgram);
+        aVertexPosition = gl.getAttribLocation(shaderProgram, "aVertexPosition");
+        initBuffers();
+      }
+    </script>
+  </head>
+  <body onload="webGLStart()">
+    <div>
+      <canvas id="canvas"></canvas>
+    </div>
+  </body>
+  <script>
+    test(function() {
+    	webGLStart();
+    });
+  </script>
+</html>
+