Index: third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.cpp |
diff --git a/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.cpp b/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.cpp |
index 9a902001dac684e122478db4de383c8623ee1e3c..d3d020d4b092f62c96f532f64ad6801a817e40cc 100644 |
--- a/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.cpp |
+++ b/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.cpp |
@@ -3463,20 +3463,28 @@ void WebGL2RenderingContextBase::drawBuffers(const Vector<GLenum>& buffers) { |
bool WebGL2RenderingContextBase::ValidateClearBuffer(const char* function_name, |
GLenum buffer, |
- GLsizei size) { |
+ GLsizei size, |
+ GLuint src_offset) { |
+ CheckedNumeric<GLsizei> checked_size(size); |
+ checked_size -= src_offset; |
+ if (!checked_size.IsValid()) { |
+ SynthesizeGLError(GL_INVALID_VALUE, function_name, |
+ "invalid array size / srcOffset"); |
+ return false; |
+ } |
switch (buffer) { |
case GL_COLOR: |
- if (size < 4) { |
+ if (checked_size.ValueOrDie() < 4) { |
SynthesizeGLError(GL_INVALID_VALUE, function_name, |
- "invalid array size"); |
+ "invalid array size / srcOffset"); |
return false; |
} |
break; |
case GL_DEPTH: |
case GL_STENCIL: |
- if (size < 1) { |
+ if (checked_size.ValueOrDie() < 1) { |
SynthesizeGLError(GL_INVALID_VALUE, function_name, |
- "invalid array size"); |
+ "invalid array size / srcOffset"); |
return false; |
} |
break; |
@@ -3498,64 +3506,74 @@ WebGLTexture* WebGL2RenderingContextBase::ValidateTexImageBinding( |
void WebGL2RenderingContextBase::clearBufferiv(GLenum buffer, |
GLint drawbuffer, |
- NotShared<DOMInt32Array> value) { |
+ NotShared<DOMInt32Array> value, |
+ GLuint src_offset) { |
if (isContextLost() || |
- !ValidateClearBuffer("clearBufferiv", buffer, value.View()->length())) |
+ !ValidateClearBuffer("clearBufferiv", buffer, value.View()->length(), |
+ src_offset)) |
return; |
- ContextGL()->ClearBufferiv(buffer, drawbuffer, value.View()->Data()); |
+ ContextGL()->ClearBufferiv(buffer, drawbuffer, |
+ value.View()->Data() + src_offset); |
} |
void WebGL2RenderingContextBase::clearBufferiv(GLenum buffer, |
GLint drawbuffer, |
- const Vector<GLint>& value) { |
+ const Vector<GLint>& value, |
+ GLuint src_offset) { |
if (isContextLost() || |
- !ValidateClearBuffer("clearBufferiv", buffer, value.size())) |
+ !ValidateClearBuffer("clearBufferiv", buffer, value.size(), src_offset)) |
return; |
- ContextGL()->ClearBufferiv(buffer, drawbuffer, value.Data()); |
+ ContextGL()->ClearBufferiv(buffer, drawbuffer, value.Data() + src_offset); |
} |
-void WebGL2RenderingContextBase::clearBufferuiv( |
- GLenum buffer, |
- GLint drawbuffer, |
- NotShared<DOMUint32Array> value) { |
+void WebGL2RenderingContextBase::clearBufferuiv(GLenum buffer, |
+ GLint drawbuffer, |
+ NotShared<DOMUint32Array> value, |
+ GLuint src_offset) { |
if (isContextLost() || |
- !ValidateClearBuffer("clearBufferuiv", buffer, value.View()->length())) |
+ !ValidateClearBuffer("clearBufferuiv", buffer, value.View()->length(), |
+ src_offset)) |
return; |
- ContextGL()->ClearBufferuiv(buffer, drawbuffer, value.View()->Data()); |
+ ContextGL()->ClearBufferuiv(buffer, drawbuffer, |
+ value.View()->Data() + src_offset); |
} |
void WebGL2RenderingContextBase::clearBufferuiv(GLenum buffer, |
GLint drawbuffer, |
- const Vector<GLuint>& value) { |
+ const Vector<GLuint>& value, |
+ GLuint src_offset) { |
if (isContextLost() || |
- !ValidateClearBuffer("clearBufferuiv", buffer, value.size())) |
+ !ValidateClearBuffer("clearBufferuiv", buffer, value.size(), src_offset)) |
return; |
- ContextGL()->ClearBufferuiv(buffer, drawbuffer, value.Data()); |
+ ContextGL()->ClearBufferuiv(buffer, drawbuffer, value.Data() + src_offset); |
} |
-void WebGL2RenderingContextBase::clearBufferfv( |
- GLenum buffer, |
- GLint drawbuffer, |
- NotShared<DOMFloat32Array> value) { |
+void WebGL2RenderingContextBase::clearBufferfv(GLenum buffer, |
+ GLint drawbuffer, |
+ NotShared<DOMFloat32Array> value, |
+ GLuint src_offset) { |
if (isContextLost() || |
- !ValidateClearBuffer("clearBufferfv", buffer, value.View()->length())) |
+ !ValidateClearBuffer("clearBufferfv", buffer, value.View()->length(), |
+ src_offset)) |
return; |
- ContextGL()->ClearBufferfv(buffer, drawbuffer, value.View()->Data()); |
+ ContextGL()->ClearBufferfv(buffer, drawbuffer, |
+ value.View()->Data() + src_offset); |
} |
void WebGL2RenderingContextBase::clearBufferfv(GLenum buffer, |
GLint drawbuffer, |
- const Vector<GLfloat>& value) { |
+ const Vector<GLfloat>& value, |
+ GLuint src_offset) { |
if (isContextLost() || |
- !ValidateClearBuffer("clearBufferfv", buffer, value.size())) |
+ !ValidateClearBuffer("clearBufferfv", buffer, value.size(), src_offset)) |
return; |
- ContextGL()->ClearBufferfv(buffer, drawbuffer, value.Data()); |
+ ContextGL()->ClearBufferfv(buffer, drawbuffer, value.Data() + src_offset); |
} |
void WebGL2RenderingContextBase::clearBufferfi(GLenum buffer, |