WebVR: Add sanity checks for decoded pose index values

third_party/WebKit/Source/modules/vr/VRDisplay.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "modules/vr/VRDisplay.h"
 
 #include "core/css/StylePropertySet.h"
 #include "core/dom/DOMException.h"
 #include "core/dom/DocumentUserGestureToken.h"
 #include "core/dom/FrameRequestCallback.h"
@@ skipping 594 matching lines @@
 
   gl->Enable(GL_SCISSOR_TEST);
   // Use a few pixels to ensure we get a clean color. The resolution for the
   // WebGL buffer may not match the final rendered destination size, and
   // texture filtering could interfere for single pixels. This isn't visible
   // since the final rendering hides the edges via a vignette effect.
   gl->Scissor(0, 0, 4, 4);
   gl->ColorMask(GL_TRUE, GL_TRUE, GL_TRUE, GL_TRUE);
   int idx = m_framePose->poseIndex;
   // Careful with the arithmetic here. Float color 1.f is equivalent to int 255.
-  gl->ClearColor((idx & 255) / 255.0f, ((idx >> 8) & 255) / 255.0f,
-                 ((idx >> 16) & 255) / 255.0f, 1.0f);
+  // Use the low byte of the index as the red component, and store an arbitrary
+  // magic number in green/blue. This number must match the reading code in
+  // vr_shell.cc. Avoid all-black/all-white.
+  gl->ClearColor((idx & 255) / 255.0f, 42 / 255.0f, 142 / 255.0f, 1.0f);

[mthiesse, 2016/12/01 21:53:15]

Make constants for the magic numbers, here and in vr_shell

[klausw, 2016/12/01 22:36:04]

Done.

   gl->Clear(GL_COLOR_BUFFER_BIT);
 
   // Set the GL state back to what was set by the WebVR application.
   m_renderingContext->restoreScissorEnabled();
   m_renderingContext->restoreScissorBox();
   m_renderingContext->restoreColorMask();
   m_renderingContext->restoreClearColor();
 
   m_display->SubmitFrame(m_framePose.Clone());
   m_canUpdateFramePose = true;
@@ skipping 74 matching lines @@
   visitor->trace(m_capabilities);
   visitor->trace(m_stageParameters);
   visitor->trace(m_eyeParametersLeft);
   visitor->trace(m_eyeParametersRight);
   visitor->trace(m_layer);
   visitor->trace(m_renderingContext);
   visitor->trace(m_scriptedAnimationController);
 }
 
 }  // namespace blink