Implement sub source for WebGL2's clearBuffer*().

third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "modules/webgl/WebGL2RenderingContextBase.h"
 
 #include <memory>
 #include "bindings/modules/v8/WebGLAny.h"
 #include "core/frame/ImageBitmap.h"
 #include "core/html/HTMLCanvasElement.h"
@@ skipping 49 matching lines @@
     // type size is at most 8, so no overflow.
     byte_length = sub_length * type_size;
   }
   long long byte_offset = 0;
   if (sub_offset) {
     // type size is at most 8, so no overflow.
     byte_offset = sub_offset * type_size;
   }
   CheckedNumeric<long long> total = byte_offset;
   total += byte_length;
-  if (!total.IsValid() || total.ValueOrDie() > view->byteLength()) {
+  if (!total.IsValid() || total.ValueOrDefault(0) > view->byteLength()) {

[Ken Russell (switch to Gerrit), 2017/04/12 18:56:49]

Here and throughout, I think we should continue to use ValueOrDie because it's
safer. If there's a code change which accidentally eliminates the IsValid()
check, ValueOrDie will prevent security bugs due to integer overflow.
ValueOrDefault runs the risk of not doing so.

[Zhenyao Mo, 2017/04/12 20:14:53]

Done.

     return false;
   }
   if (!byte_length) {
     byte_length = view->byteLength() - byte_offset;
   }
   uint8_t* data = static_cast<uint8_t*>(view->BaseAddress());
   data += byte_offset;
   *out_base_address = data;
   *out_byte_length = byte_length;
   return true;
@@ skipping 3375 matching lines @@
                           "COLOR_ATTACHMENTi_EXT or NONE");
         return;
       }
     }
     framebuffer_binding_->DrawBuffers(buffers);
   }
 }
 
 bool WebGL2RenderingContextBase::ValidateClearBuffer(const char* function_name,
                                                      GLenum buffer,
-                                                     GLsizei size) {
+                                                     GLsizei size,
+                                                     GLuint src_offset) {
+  CheckedNumeric<GLsizei> checked_size(size);
+  checked_size -= src_offset;
+  if (!checked_size.IsValid()) {
+    SynthesizeGLError(GL_INVALID_VALUE, function_name,
+                      "invalid array size / srcOffset");
+    return false;
+  }
   switch (buffer) {
     case GL_COLOR:
-      if (size < 4) {
+      if (checked_size.ValueOrDefault(0) < 4) {
         SynthesizeGLError(GL_INVALID_VALUE, function_name,
-                          "invalid array size");
+                          "invalid array size / srcOffset");
         return false;
       }
       break;
     case GL_DEPTH:
     case GL_STENCIL:
-      if (size < 1) {
+      if (checked_size.ValueOrDefault(0) < 1) {
         SynthesizeGLError(GL_INVALID_VALUE, function_name,
-                          "invalid array size");
+                          "invalid array size / srcOffset");
         return false;
       }
       break;
     default:
       SynthesizeGLError(GL_INVALID_ENUM, function_name, "invalid buffer");
       return false;
   }
   return true;
 }
 
 WebGLTexture* WebGL2RenderingContextBase::ValidateTexImageBinding(
     const char* func_name,
     TexImageFunctionID function_id,
     GLenum target) {
   if (function_id == kTexImage3D || function_id == kTexSubImage3D)
     return ValidateTexture3DBinding(func_name, target);
   return ValidateTexture2DBinding(func_name, target);
 }
 
 void WebGL2RenderingContextBase::clearBufferiv(GLenum buffer,
                                                GLint drawbuffer,
-                                               NotShared<DOMInt32Array> value) {
+                                               NotShared<DOMInt32Array> value,
+                                               GLuint src_offset) {
   if (isContextLost() ||
-      !ValidateClearBuffer("clearBufferiv", buffer, value.View()->length()))
+      !ValidateClearBuffer("clearBufferiv", buffer, value.View()->length(),
+                           src_offset))
     return;
 
-  ContextGL()->ClearBufferiv(buffer, drawbuffer, value.View()->Data());
+  ContextGL()->ClearBufferiv(buffer, drawbuffer,
+                             value.View()->Data() + src_offset);
 }
 
 void WebGL2RenderingContextBase::clearBufferiv(GLenum buffer,
                                                GLint drawbuffer,
-                                               const Vector<GLint>& value) {
+                                               const Vector<GLint>& value,
+                                               GLuint src_offset) {
   if (isContextLost() ||
-      !ValidateClearBuffer("clearBufferiv", buffer, value.size()))
+      !ValidateClearBuffer("clearBufferiv", buffer, value.size(), src_offset))
     return;
 
-  ContextGL()->ClearBufferiv(buffer, drawbuffer, value.Data());
-}
-
-void WebGL2RenderingContextBase::clearBufferuiv(
-    GLenum buffer,
-    GLint drawbuffer,
-    NotShared<DOMUint32Array> value) {
-  if (isContextLost() ||
-      !ValidateClearBuffer("clearBufferuiv", buffer, value.View()->length()))
-    return;
-
-  ContextGL()->ClearBufferuiv(buffer, drawbuffer, value.View()->Data());
+  ContextGL()->ClearBufferiv(buffer, drawbuffer, value.Data() + src_offset);
 }
 
 void WebGL2RenderingContextBase::clearBufferuiv(GLenum buffer,
                                                 GLint drawbuffer,
-                                                const Vector<GLuint>& value) {
+                                                NotShared<DOMUint32Array> value,
+                                                GLuint src_offset) {
   if (isContextLost() ||
-      !ValidateClearBuffer("clearBufferuiv", buffer, value.size()))
+      !ValidateClearBuffer("clearBufferuiv", buffer, value.View()->length(),
+                           src_offset))
     return;
 
-  ContextGL()->ClearBufferuiv(buffer, drawbuffer, value.Data());
+  ContextGL()->ClearBufferuiv(buffer, drawbuffer,
+                              value.View()->Data() + src_offset);
 }
 
-void WebGL2RenderingContextBase::clearBufferfv(
-    GLenum buffer,
-    GLint drawbuffer,
-    NotShared<DOMFloat32Array> value) {
+void WebGL2RenderingContextBase::clearBufferuiv(GLenum buffer,
+                                                GLint drawbuffer,
+                                                const Vector<GLuint>& value,
+                                                GLuint src_offset) {
   if (isContextLost() ||
-      !ValidateClearBuffer("clearBufferfv", buffer, value.View()->length()))
+      !ValidateClearBuffer("clearBufferuiv", buffer, value.size(), src_offset))
     return;
 
-  ContextGL()->ClearBufferfv(buffer, drawbuffer, value.View()->Data());
+  ContextGL()->ClearBufferuiv(buffer, drawbuffer, value.Data() + src_offset);
 }
 
 void WebGL2RenderingContextBase::clearBufferfv(GLenum buffer,
                                                GLint drawbuffer,
-                                               const Vector<GLfloat>& value) {
+                                               NotShared<DOMFloat32Array> value,
+                                               GLuint src_offset) {
   if (isContextLost() ||
-      !ValidateClearBuffer("clearBufferfv", buffer, value.size()))
+      !ValidateClearBuffer("clearBufferfv", buffer, value.View()->length(),
+                           src_offset))
     return;
 
-  ContextGL()->ClearBufferfv(buffer, drawbuffer, value.Data());
+  ContextGL()->ClearBufferfv(buffer, drawbuffer,
+                             value.View()->Data() + src_offset);
+}
+
+void WebGL2RenderingContextBase::clearBufferfv(GLenum buffer,
+                                               GLint drawbuffer,
+                                               const Vector<GLfloat>& value,
+                                               GLuint src_offset) {
+  if (isContextLost() ||
+      !ValidateClearBuffer("clearBufferfv", buffer, value.size(), src_offset))
+    return;
+
+  ContextGL()->ClearBufferfv(buffer, drawbuffer, value.Data() + src_offset);
 }
 
 void WebGL2RenderingContextBase::clearBufferfi(GLenum buffer,
                                                GLint drawbuffer,
                                                GLfloat depth,
                                                GLint stencil) {
   if (isContextLost())
     return;
 
   ContextGL()->ClearBufferfi(buffer, drawbuffer, depth, stencil);
@@ skipping 2056 matching lines @@
   return nullptr;
 }
 
 const char* WebGL2RenderingContextBase::ValidateGetBufferSubDataBounds(
     const char* function_name,
     WebGLBuffer* source_buffer,
     GLintptr source_byte_offset,
     long long destination_byte_length) {
   CheckedNumeric<long long> src_end = source_byte_offset;
   src_end += destination_byte_length;
-  if (!src_end.IsValid() || src_end.ValueOrDie() > source_buffer->GetSize()) {
+  if (!src_end.IsValid() ||
+      src_end.ValueOrDefault(0) > source_buffer->GetSize()) {
     SynthesizeGLError(GL_INVALID_VALUE, function_name,
                       "overflow of bound buffer");
     return "Invalid value: overflow of bound buffer";
   }
 
   return nullptr;
 }
 
 void WebGL2RenderingContextBase::RemoveBoundBuffer(WebGLBuffer* buffer) {
   if (bound_copy_read_buffer_ == buffer)
@@ skipping 44 matching lines @@
 
 void WebGL2RenderingContextBase::
     DrawingBufferClientRestorePixelUnpackBufferBinding() {
   if (!ContextGL())
     return;
   ContextGL()->BindBuffer(GL_PIXEL_UNPACK_BUFFER,
                           ObjectOrZero(bound_pixel_unpack_buffer_.Get()));
 }
 
 }  // namespace blink