Bug 1324710 - Fix deqp/functional/gles3/negativestateapi.html - r=daoshengmu draft
authorJeff Gilbert <jgilbert@mozilla.com>
Mon, 19 Dec 2016 23:47:55 -0800
changeset 451418 7d0e9449b6d622c73f4e6e7748df23c9ffde0119
parent 451333 339ec2f44b982e6b96aa9bd6b50836fab1dfa9ef
child 451419 c46534833e49787b5064333c88cd0b5ecac9e2a8
push id39162
push userbmo:jgilbert@mozilla.com
push dateTue, 20 Dec 2016 08:22:58 +0000
reviewersdaoshengmu
bugs1324710
milestone53.0a1
Bug 1324710 - Fix deqp/functional/gles3/negativestateapi.html - r=daoshengmu MozReview-Commit-ID: 2seTY1tEtvX
dom/canvas/WebGL2ContextUniforms.cpp
dom/canvas/WebGLContextGL.cpp
--- a/dom/canvas/WebGL2ContextUniforms.cpp
+++ b/dom/canvas/WebGL2ContextUniforms.cpp
@@ -177,16 +177,24 @@ WebGL2Context::GetActiveUniforms(JSConte
         return;
 
     if (!ValidateUniformEnum(this, pname, funcName))
         return;
 
     if (!ValidateObject("getActiveUniforms: program", program))
         return;
 
+    const auto& numActiveUniforms = program.LinkInfo()->uniforms.size();
+    for (const auto& curIndex : uniformIndices) {
+        if (curIndex >= numActiveUniforms) {
+            ErrorInvalidValue("%s: Too-large active uniform index queried.", funcName);
+            return;
+        }
+    }
+
     const auto& count = uniformIndices.Length();
 
     JS::Rooted<JSObject*> array(cx, JS_NewArrayObject(cx, count));
     UniquePtr<GLint[]> samples(new GLint[count]);
     if (!array || !samples) {
         ErrorOutOfMemory("%s: Failed to allocate buffers.", funcName);
         return;
     }
--- a/dom/canvas/WebGLContextGL.cpp
+++ b/dom/canvas/WebGLContextGL.cpp
@@ -687,19 +687,16 @@ WebGLContext::GetFramebufferAttachmentPa
         default:
             ErrorInvalidEnum("%s: With the default framebuffer, can only query COLOR, DEPTH,"
                              " or STENCIL for GL_FRAMEBUFFER_ATTACHMENT_OBJECT_TYPE",
                              funcName);
             return JS::NullValue();
         }
         return JS::Int32Value(LOCAL_GL_FRAMEBUFFER_DEFAULT);
 
-    case LOCAL_GL_FRAMEBUFFER_ATTACHMENT_OBJECT_NAME:
-        return JS::NullValue();
-
     ////////////////
 
     case LOCAL_GL_FRAMEBUFFER_ATTACHMENT_RED_SIZE:
     case LOCAL_GL_FRAMEBUFFER_ATTACHMENT_GREEN_SIZE:
     case LOCAL_GL_FRAMEBUFFER_ATTACHMENT_BLUE_SIZE:
         if (attachment == LOCAL_GL_BACK)
             return JS::NumberValue(8);
         return JS::NumberValue(0);