Attachment 163157 Details for Bug 93871 – Patch

[patch] Patch

93871-2.patch (text/plain), 25.93 KB, created by Max Vujovic on 2012-09-10 10:06:43 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Max Vujovic

Created: 2012-09-10 10:06:43 PDT

Size: 25.93 KB

patch

obsolete

>diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
>index 1dd440c..37ba012 100644
>--- a/LayoutTests/ChangeLog
>+++ b/LayoutTests/ChangeLog
>@@ -1,3 +1,28 @@
>+2012-09-09  Max Vujovic  <mvujovic@adobe.com>
>+
>+        [CSS Shaders] Remove direct texture access via u_texture
>+        https://bugs.webkit.org/show_bug.cgi?id=93871
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Add tests to verify that the "u_texture" sampler is no longer accessible to author shader
>+        code because it was removed. These tests also verify that shaders with unbound samplers do
>+        not execute.
>+
>+        Add tests to verify that the internal "css_u_texture" sampler is not accessible to author
>+        shader code. These tests check that this is true whether or not the author is using the CSS
>+        mix function and whether or not the author attempts to define css_u_texture is his or her
>+        shader.
>+
>+        * css3/filters/custom/custom-filter-no-element-texture-access-expected.html: Added.
>+        * css3/filters/custom/custom-filter-no-element-texture-access.html: Added.
>+        * css3/filters/resources/sample-defined-css-u-texture-mix.fs: Added.
>+        * css3/filters/resources/sample-defined-css-u-texture.fs: Added.
>+        * css3/filters/resources/sample-u-texture-mix.fs: Added.
>+        * css3/filters/resources/sample-u-texture.fs: Added.
>+        * css3/filters/resources/sample-undefined-css-u-texture-mix.fs: Added.
>+        * css3/filters/resources/sample-undefined-css-u-texture.fs: Added.
>+
> 2012-09-08  Adam Barth  <abarth@chromium.org>
> 
>         [V8] DOM wrapper creation involves a bunch of sketchy code related to finding the Frame
>diff --git a/LayoutTests/css3/filters/custom/custom-filter-no-element-texture-access-expected.html b/LayoutTests/css3/filters/custom/custom-filter-no-element-texture-access-expected.html
>new file mode 100644
>index 0000000..1d84048
>--- /dev/null
>+++ b/LayoutTests/css3/filters/custom/custom-filter-no-element-texture-access-expected.html
>@@ -0,0 +1,26 @@
>+<!doctype html>
>+<html>
>+<head>
>+    <title>Tests that an author's shader code cannot sample a shaded element's texture.</title>
>+    
>+    <style>
>+    div {
>+        background-color: rgb(0, 255, 0);
>+        width: 50px;
>+        height: 50px;
>+        margin: 10px;
>+    }
>+    </style>
>+</head>
>+<body>
>+    <div></div>
>+    <div></div>
>+    <div></div>
>+    <div></div>
>+    <div></div>
>+    <div></div>
>+</body>
>+</html>
>diff --git a/LayoutTests/css3/filters/custom/custom-filter-no-element-texture-access.html b/LayoutTests/css3/filters/custom/custom-filter-no-element-texture-access.html
>new file mode 100644
>index 0000000..5a84936
>--- /dev/null
>+++ b/LayoutTests/css3/filters/custom/custom-filter-no-element-texture-access.html
>@@ -0,0 +1,48 @@
>+<!doctype html>
>+<html>
>+<head>
>+    <title>Tests that an author's shader code cannot sample a shaded element's texture.</title>
>+    
>+    <script>
>+        if (window.testRunner) {
>+            window.testRunner.overridePreference("WebKitCSSCustomFilterEnabled", "1");
>+            window.testRunner.overridePreference("WebKitWebGLEnabled", "1");
>+        }
>+    </script>
>+    <style>
>+    div {
>+        /* The shaders will turn the element's color from green to red if they are able to sample its texture. */
>+        background-color: rgb(0, 255, 0);
>+        width: 50px;
>+        height: 50px;
>+        margin: 10px;
>+    }
>+    .sample-u-texture {
>+        -webkit-filter: custom(url('../resources/pass-tex-coord.vs') url('../resources/sample-u-texture.fs'));
>+    }
>+    .sample-u-texture-mix {
>+        -webkit-filter: custom(url('../resources/pass-tex-coord.vs') mix(url('../resources/sample-u-texture-mix.fs') normal source-atop));
>+    }
>+    .sample-undefined-css-u-texture {
>+        -webkit-filter: custom(url('../resources/pass-tex-coord.vs') url('../resources/sample-undefined-css-u-texture.fs'));  
>+    }
>+    .sample-undefined-css-u-texture-mix {
>+        -webkit-filter: custom(url('../resources/pass-tex-coord.vs') mix(url('../resources/sample-undefined-css-u-texture-mix.fs') normal source-atop));
>+    }
>+    .sample-defined-css-u-texture {
>+        -webkit-filter: custom(url('../resources/pass-tex-coord.vs') url('../resources/sample-defined-css-u-texture.fs'));  
>+    }
>+    .sample-defined-css-u-texture-mix {
>+        -webkit-filter: custom(url('../resources/pass-tex-coord.vs') mix(url('../resources/sample-defined-css-u-texture-mix.fs') normal source-atop));
>+    }
>+    </style>
>+</head>
>+<body>
>+    <div class="sample-u-texture"></div>
>+    <div class="sample-u-texture-mix"></div>
>+    <div class="sample-undefined-css-u-texture"></div>
>+    <div class="sample-undefined-css-u-texture-mix"></div>
>+    <div class="sample-defined-css-u-texture"></div>
>+    <div class="sample-defined-css-u-texture-mix"></div>
>+</body>
>+</html>
>diff --git a/LayoutTests/css3/filters/resources/sample-defined-css-u-texture-mix.fs b/LayoutTests/css3/filters/resources/sample-defined-css-u-texture-mix.fs
>new file mode 100644
>index 0000000..cef9885
>--- /dev/null
>+++ b/LayoutTests/css3/filters/resources/sample-defined-css-u-texture-mix.fs
>@@ -0,0 +1,20 @@
>+// This test checks that a shader cannot read from the internal "css_u_texture" sampler, which references the DOM element texture.
>+// This shader is referenced from the CSS mix function and should fail to validate because it defines "css_u_texture",
>+// using the restricted "css_" prefix.
>+
>+precision mediump float;
>+
>+uniform sampler2D css_u_texture;
>+
>+varying vec2 v_texCoord;
>+
>+void main()
>+{
>+	// Try to sample the DOM element texture.
>+	vec4 color = texture2D(css_u_texture, v_texCoord);
>+
>+	// Swap the red and green channels.
>+	color.rg = color.gr;
>+
>+	css_MixColor = color;
>+}
>diff --git a/LayoutTests/css3/filters/resources/sample-defined-css-u-texture.fs b/LayoutTests/css3/filters/resources/sample-defined-css-u-texture.fs
>new file mode 100644
>index 0000000..5846d17
>--- /dev/null
>+++ b/LayoutTests/css3/filters/resources/sample-defined-css-u-texture.fs
>@@ -0,0 +1,20 @@
>+// This test checks that a shader cannot read from the internal "css_u_texture" sampler, which references the DOM element texture.
>+// This shader should fail to validate because it defines "css_u_texture", which should be an unbound sampler,
>+// since this shader is not referenced from the CSS mix function.
>+
>+precision mediump float;
>+
>+uniform sampler2D css_u_texture;
>+
>+varying vec2 v_texCoord;
>+
>+void main()
>+{
>+	// Try to sample the DOM element texture.
>+	vec4 color = texture2D(css_u_texture, v_texCoord);
>+
>+	// Swap the red and green channels.
>+	color.rg = color.gr;
>+
>+	gl_FragColor = color;
>+}
>diff --git a/LayoutTests/css3/filters/resources/sample-u-texture-mix.fs b/LayoutTests/css3/filters/resources/sample-u-texture-mix.fs
>new file mode 100644
>index 0000000..d5f3522
>--- /dev/null
>+++ b/LayoutTests/css3/filters/resources/sample-u-texture-mix.fs
>@@ -0,0 +1,19 @@
>+// This test checks that a shader with an unbound sampler is not permitted to execute.
>+// This shader is referenced from the CSS mix function and writes its output to css_MixColor.
>+
>+precision mediump float;
>+
>+uniform sampler2D u_texture;
>+
>+varying vec2 v_texCoord;
>+
>+void main()
>+{
>+	// Try to sample the DOM element texture.
>+	vec4 color = texture2D(u_texture, v_texCoord);
>+
>+	// Swap the red and green channels.
>+	color.rg = color.gr;
>+
>+	css_MixColor = color;
>+}
>diff --git a/LayoutTests/css3/filters/resources/sample-u-texture.fs b/LayoutTests/css3/filters/resources/sample-u-texture.fs
>new file mode 100644
>index 0000000..3c02b85
>--- /dev/null
>+++ b/LayoutTests/css3/filters/resources/sample-u-texture.fs
>@@ -0,0 +1,19 @@
>+// This test checks that a shader with an unbound sampler is not permitted to execute.
>+// This shader is not referenced from the CSS mix function and writes its output to gl_FragColor.
>+
>+precision mediump float;
>+
>+uniform sampler2D u_texture;
>+
>+varying vec2 v_texCoord;
>+
>+void main()
>+{
>+	// Try to sample the DOM element texture.
>+	vec4 color = texture2D(u_texture, v_texCoord);
>+
>+	// Swap the red and green channels.
>+	color.rg = color.gr;
>+
>+	gl_FragColor = color;
>+}
>diff --git a/LayoutTests/css3/filters/resources/sample-undefined-css-u-texture-mix.fs b/LayoutTests/css3/filters/resources/sample-undefined-css-u-texture-mix.fs
>new file mode 100644
>index 0000000..cb966b0
>--- /dev/null
>+++ b/LayoutTests/css3/filters/resources/sample-undefined-css-u-texture-mix.fs
>@@ -0,0 +1,17 @@
>+// This test checks that a shader cannot read from the internal "css_u_texture" sampler, which references the DOM element texture.
>+// This shader should fail to validate because "css_u_texture" should be undefined to this code.
>+
>+precision mediump float;
>+
>+varying vec2 v_texCoord;
>+
>+void main()
>+{
>+	// Try to sample the DOM element texture.
>+	vec4 color = texture2D(css_u_texture, v_texCoord);
>+
>+	// Swap the red and green channels.
>+	color.rg = color.gr;
>+
>+	css_MixColor = color;
>+}
>diff --git a/LayoutTests/css3/filters/resources/sample-undefined-css-u-texture.fs b/LayoutTests/css3/filters/resources/sample-undefined-css-u-texture.fs
>new file mode 100644
>index 0000000..d1e2f2a
>--- /dev/null
>+++ b/LayoutTests/css3/filters/resources/sample-undefined-css-u-texture.fs
>@@ -0,0 +1,17 @@
>+// This test checks that a shader cannot read from the internal "css_u_texture" sampler, which references the DOM element texture.
>+// This shader should fail to validate because "css_u_texture" should be undefined to this code.
>+
>+precision mediump float;
>+
>+varying vec2 v_texCoord;
>+
>+void main()
>+{
>+	// Try to sample the DOM element texture.
>+	vec4 color = texture2D(css_u_texture, v_texCoord);
>+
>+	// Swap the red and green channels.
>+	color.rg = color.gr;
>+
>+	gl_FragColor = color;
>+}
>diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
>index 1bcaafa..d03d98f 100644
>--- a/Source/WebCore/ChangeLog
>+++ b/Source/WebCore/ChangeLog
>@@ -1,3 +1,56 @@
>+2012-09-09  Max Vujovic  <mvujovic@adobe.com>
>+
>+        [CSS Shaders] Remove direct texture access via u_texture
>+        https://bugs.webkit.org/show_bug.cgi?id=93871
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Remove the author-accessible "u_texture" sampler, which referenced the DOM element texture.
>+
>+        Additionally, reject shaders with author-defined sampler uniforms. When we implement texture 
>+        parameters, we will allow shaders whose samplers are bound to valid textures. We must not
>+        allow OpenGL to give unbound samplers a default value of 0 because that references the DOM
>+        element texture, which should be inaccessible to the author's shader code.
>+
>+        Test: css3/filters/custom/custom-filter-no-element-texture-access.html
>+
>+        * platform/graphics/ANGLEWebKitBridge.cpp:
>+        (WebCore::ANGLEWebKitBridge::getUniformInfo):
>+            Add a new public method to ANGLEWebKitBridge which gets the info about all of the
>+            uniforms in the last validated vertex shader or fragment shader. Uniform info includes
>+            includes name, type, and size.
>+        (WebCore):
>+        (WebCore::ANGLEWebKitBridge::getParameterValue):
>+            Add a private method to ANGLEWebKitBridge to easily query the various integer parameters
>+            that ANGLE exposes. The new getUniformInfo method and the existing validateShaderSource
>+            method now both use getParameterValue.
>+        (WebCore::ANGLEWebKitBridge::isSamplerType):
>+            Add a public method to ANGLEWebKitBridge that returns true if a uniform's type is a
>+            GLSL sampler (e.g. sampler2D, samplerCube, etc.).
>+        (WebCore::ANGLEWebKitBridge::validateShaderSource):
>+            Use the new getParameterValue method instead of ANGLE's ShGetInfo function.
>+        * platform/graphics/ANGLEWebKitBridge.h:
>+        (ANGLEUniformInfo):
>+        (WebCore):
>+        (ANGLEWebKitBridge):
>+        * platform/graphics/filters/CustomFilterCompiledProgram.cpp:
>+        (WebCore::CustomFilterCompiledProgram::CustomFilterCompiledProgram):
>+            Take in an additional constructor parameter that indicates whether the shaders are
>+            referenced from the CSS mix function.
>+        (WebCore::CustomFilterCompiledProgram::initializeParameterLocations):
>+            Remove the author-accessible DOM element texture sampler "u_texture".
>+            Only find the location of the internal DOM element texture sampler "css_u_texture"
>+            if the author is using the CSS mix function.
>+        * platform/graphics/filters/CustomFilterCompiledProgram.h:
>+        * platform/graphics/filters/CustomFilterValidatedProgram.cpp:
>+            Reject all shaders that have sampler uniforms defined.
>+        (WebCore::CustomFilterValidatedProgram::CustomFilterValidatedProgram):
>+        (WebCore::CustomFilterValidatedProgram::compiledProgram):
>+        * platform/graphics/filters/FECustomFilter.cpp:
>+        (WebCore::FECustomFilter::bindProgramAndBuffers):
>+            Add an assert to verify that the DOM element texture is bound only if the author is
>+            using the CSS mix function.
>+
> 2012-09-09  Adam Barth  <abarth@webkit.org>
> 
>         [V8] convertEventTargetToV8Object doesn't need to be overloaded
>diff --git a/Source/WebCore/platform/graphics/ANGLEWebKitBridge.cpp b/Source/WebCore/platform/graphics/ANGLEWebKitBridge.cpp
>index 5c528cf..1f12b80 100644
>--- a/Source/WebCore/platform/graphics/ANGLEWebKitBridge.cpp
>+++ b/Source/WebCore/platform/graphics/ANGLEWebKitBridge.cpp
>@@ -92,8 +92,7 @@ bool ANGLEWebKitBridge::validateShaderSource(const char* shaderSource, ANGLEShad
> 
>     bool validateSuccess = ShCompile(compiler, shaderSourceStrings, 1, SH_OBJECT_CODE | extraCompileOptions);
>     if (!validateSuccess) {
>-        int logSize = 0;
>-        ShGetInfo(compiler, SH_INFO_LOG_LENGTH, &logSize);
>+        int logSize = getParameterValue(compiler, SH_INFO_LOG_LENGTH);
>         if (logSize > 1) {
>             OwnArrayPtr<char> logBuffer = adoptArrayPtr(new char[logSize]);
>             if (logBuffer) {
>@@ -104,8 +103,7 @@ bool ANGLEWebKitBridge::validateShaderSource(const char* shaderSource, ANGLEShad
>         return false;
>     }
> 
>-    int translationLength = 0;
>-    ShGetInfo(compiler, SH_OBJECT_CODE_LENGTH, &translationLength);
>+    int translationLength = getParameterValue(compiler, SH_OBJECT_CODE_LENGTH);
>     if (translationLength > 1) {
>         OwnArrayPtr<char> translationBuffer = adoptArrayPtr(new char[translationLength]);
>         if (!translationBuffer)
>@@ -117,6 +115,45 @@ bool ANGLEWebKitBridge::validateShaderSource(const char* shaderSource, ANGLEShad
>     return true;
> }
> 
>+void ANGLEWebKitBridge::getUniformInfo(ShShaderType shaderType, Vector<ANGLEUniformInfo> &infoVector)
>+{
>+    const ShHandle compiler = (shaderType == SH_VERTEX_SHADER ? m_vertexCompiler : m_fragmentCompiler);
>+
>+    int numUniforms = getParameterValue(compiler, SH_ACTIVE_UNIFORMS);
>+    if (numUniforms <= 0)
>+        return;
>+
>+    int maxNameLength = getParameterValue(compiler, SH_ACTIVE_UNIFORM_MAX_LENGTH);
>+    // The max length for a uniform name should be at least one character long.
>+    ASSERT(maxNameLength > 0);
>+    OwnArrayPtr<char> nameBuffer = adoptArrayPtr(new char[maxNameLength]);
>+
>+    for (int i = 0; i < numUniforms; ++i) {
>+        ANGLEUniformInfo info;
>+        int nameLength = -1;
>+        ShGetActiveUniform(compiler, i, &nameLength, &info.size, &info.type, nameBuffer.get(), 0);
>+        // A uniform name should be at least one character long.
>+        ASSERT(nameLength > 0);
>+        info.name = nameBuffer.get();
>+        infoVector.append(info);
>+    }
>+}
>+
>+int ANGLEWebKitBridge::getParameterValue(const ShHandle compiler, ShShaderInfo parameterName)
>+{
>+    int parameter = -1;
>+    ShGetInfo(compiler, parameterName, &parameter);
>+    return parameter;
>+}
>+
>+bool ANGLEWebKitBridge::isSamplerType(ShDataType dataType)
>+{
>+    return dataType == SH_SAMPLER_2D
>+        || dataType == SH_SAMPLER_CUBE
>+        || dataType == SH_SAMPLER_2D_RECT_ARB
>+        || dataType == SH_SAMPLER_EXTERNAL_OES;
>+}
>+
> }
> 
> #endif // USE(3D_GRAPHICS)
>diff --git a/Source/WebCore/platform/graphics/ANGLEWebKitBridge.h b/Source/WebCore/platform/graphics/ANGLEWebKitBridge.h
>index 26f3012..40236f3 100644
>--- a/Source/WebCore/platform/graphics/ANGLEWebKitBridge.h
>+++ b/Source/WebCore/platform/graphics/ANGLEWebKitBridge.h
>@@ -42,6 +42,12 @@ enum ANGLEShaderType {
>     SHADER_TYPE_FRAGMENT = SH_FRAGMENT_SHADER,
> };
> 
>+struct ANGLEUniformInfo {
>+    String name;
>+    ShDataType type;
>+    int size;
>+};
>+
> class ANGLEWebKitBridge {
> public:
> 
>@@ -53,8 +59,15 @@ public:
>     
>     bool validateShaderSource(const char* shaderSource, ANGLEShaderType, String& translatedShaderSource, String& shaderValidationLog, int extraCompileOptions = 0);
> 
>+    // Get the uniform info for the last validated shader of type shaderType.
>+    void getUniformInfo(ShShaderType, Vector<ANGLEUniformInfo> &infoVector);
>+
>+    static bool isSamplerType(ShDataType);
>+
> private:
> 
>+    int getParameterValue(const ShHandle compiler, ShShaderInfo parameterName);
>+
>     void cleanupCompilers();
> 
>     bool builtCompilers;
>diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterCompiledProgram.cpp b/Source/WebCore/platform/graphics/filters/CustomFilterCompiledProgram.cpp
>index 3c6959b..eca2b9f 100644
>--- a/Source/WebCore/platform/graphics/filters/CustomFilterCompiledProgram.cpp
>+++ b/Source/WebCore/platform/graphics/filters/CustomFilterCompiledProgram.cpp
>@@ -36,7 +36,7 @@
> 
> namespace WebCore {
> 
>-CustomFilterCompiledProgram::CustomFilterCompiledProgram(PassRefPtr<GraphicsContext3D> context, const String& validatedVertexShader, const String& validatedFragmentShader)
>+CustomFilterCompiledProgram::CustomFilterCompiledProgram(PassRefPtr<GraphicsContext3D> context, const String& validatedVertexShader, const String& validatedFragmentShader, bool mixEnabled)
>     : m_context(context)
>     , m_program(0)
>     , m_positionAttribLocation(-1)
>@@ -73,7 +73,7 @@ CustomFilterCompiledProgram::CustomFilterCompiledProgram(PassRefPtr<GraphicsCont
>     if (!m_program)
>         return;
>     
>-    initializeParameterLocations();
>+    initializeParameterLocations(mixEnabled);
>     
>     m_isInitialized = true;
> }
>@@ -117,7 +117,7 @@ Platform3DObject CustomFilterCompiledProgram::linkProgram(Platform3DObject verte
>     return program;
> }
> 
>-void CustomFilterCompiledProgram::initializeParameterLocations()
>+void CustomFilterCompiledProgram::initializeParameterLocations(bool mixEnabled)
> {
>     m_positionAttribLocation = m_context->getAttribLocation(m_program, "a_position");
>     m_texAttribLocation = m_context->getAttribLocation(m_program, "a_texCoord");
>@@ -129,12 +129,15 @@ void CustomFilterCompiledProgram::initializeParameterLocations()
>     m_projectionMatrixLocation = m_context->getUniformLocation(m_program, "u_projectionMatrix");
>     m_samplerSizeLocation = m_context->getUniformLocation(m_program, "u_textureSize");
>     m_contentSamplerLocation = m_context->getUniformLocation(m_program, "u_contentTexture");
>-    m_internalTexCoordAttribLocation = m_context->getAttribLocation(m_program, "css_a_texCoord");
>-    m_samplerLocation = m_context->getUniformLocation(m_program, "css_u_texture");
>-    // FIXME: Remove texture access via u_texture and change the tests to use blending and compositing.
>-    // https://bugs.webkit.org/show_bug.cgi?id=93871
>-    if (m_samplerLocation == -1)
>-        m_samplerLocation = m_context->getUniformLocation(m_program, "u_texture");
>+    if (mixEnabled) {
>+        // Only enable these internal symbols if the author is using the CSS mix function.
>+        m_internalTexCoordAttribLocation = m_context->getAttribLocation(m_program, "css_a_texCoord");
>+        m_samplerLocation = m_context->getUniformLocation(m_program, "css_u_texture");
>+
>+        // These internal symbols should have been added to the validated shaders.
>+        ASSERT(m_internalTexCoordAttribLocation != -1);
>+        ASSERT(m_samplerLocation != -1);
>+    }
> }
> 
> int CustomFilterCompiledProgram::uniformLocationByName(const String& name)
>diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterCompiledProgram.h b/Source/WebCore/platform/graphics/filters/CustomFilterCompiledProgram.h
>index ad945f6..713a121 100644
>--- a/Source/WebCore/platform/graphics/filters/CustomFilterCompiledProgram.h
>+++ b/Source/WebCore/platform/graphics/filters/CustomFilterCompiledProgram.h
>@@ -42,9 +42,9 @@ class CustomFilterGlobalContext;
> 
> class CustomFilterCompiledProgram: public RefCounted<CustomFilterCompiledProgram> {
> public:
>-    static PassRefPtr<CustomFilterCompiledProgram> create(PassRefPtr<GraphicsContext3D> context, const String& validatedVertexShader, const String& validatedFragmentShader)
>+    static PassRefPtr<CustomFilterCompiledProgram> create(PassRefPtr<GraphicsContext3D> context, const String& validatedVertexShader, const String& validatedFragmentShader, bool mixEnabled)
>     {
>-        return adoptRef(new CustomFilterCompiledProgram(context, validatedVertexShader, validatedFragmentShader));
>+        return adoptRef(new CustomFilterCompiledProgram(context, validatedVertexShader, validatedFragmentShader, mixEnabled));
>     }
>     
>     ~CustomFilterCompiledProgram();
>@@ -73,11 +73,11 @@ public:
>     
>     Platform3DObject program() const { return m_program; }
> private:
>-    CustomFilterCompiledProgram(PassRefPtr<GraphicsContext3D>, const String& validatedVertexShader, const String& validatedFragmentShader);
>+    CustomFilterCompiledProgram(PassRefPtr<GraphicsContext3D>, const String& validatedVertexShader, const String& validatedFragmentShader, bool mixEnabled);
>     
>     Platform3DObject compileShader(GC3Denum shaderType, const String& shaderString);
>     Platform3DObject linkProgram(Platform3DObject vertexShader, Platform3DObject fragmentShader);
>-    void initializeParameterLocations();
>+    void initializeParameterLocations(bool mixEnabled);
>     
>     RefPtr<GraphicsContext3D> m_context;
>     Platform3DObject m_program;
>diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterValidatedProgram.cpp b/Source/WebCore/platform/graphics/filters/CustomFilterValidatedProgram.cpp
>index a7dacdb..5109a42 100644
>--- a/Source/WebCore/platform/graphics/filters/CustomFilterValidatedProgram.cpp
>+++ b/Source/WebCore/platform/graphics/filters/CustomFilterValidatedProgram.cpp
>@@ -85,14 +85,29 @@ CustomFilterValidatedProgram::CustomFilterValidatedProgram(CustomFilterGlobalCon
>     // Shaders referenced from the CSS mix function use a different validator than regular WebGL shaders. See CustomFilterGlobalContext.h for more details.
>     ANGLEWebKitBridge* validator = programInfo.mixSettings().enabled ? m_globalContext->mixShaderValidator() : m_globalContext->webglShaderValidator();
>     String vertexShaderLog, fragmentShaderLog;
>-    bool vertexShaderValid = validator->validateShaderSource(originalVertexShader.utf8().data(), SHADER_TYPE_VERTEX, m_validatedVertexShader, vertexShaderLog);
>-    bool fragmentShaderValid = validator->validateShaderSource(originalFragmentShader.utf8().data(), SHADER_TYPE_FRAGMENT, m_validatedFragmentShader, fragmentShaderLog);
>+    bool vertexShaderValid = validator->validateShaderSource(originalVertexShader.utf8().data(), SHADER_TYPE_VERTEX, m_validatedVertexShader, vertexShaderLog, SH_ATTRIBUTES_UNIFORMS);
>+    bool fragmentShaderValid = validator->validateShaderSource(originalFragmentShader.utf8().data(), SHADER_TYPE_FRAGMENT, m_validatedFragmentShader, fragmentShaderLog, SH_ATTRIBUTES_UNIFORMS);
>     if (!vertexShaderValid || !fragmentShaderValid) {
>         // FIXME: Report the validation errors.
>         // https://bugs.webkit.org/show_bug.cgi?id=74416
>         return;
>     }
> 
>+    // Validate the author's samplers.
>+    Vector<ANGLEUniformInfo> uniformInfo;
>+    validator->getUniformInfo(SH_VERTEX_SHADER, uniformInfo);
>+    validator->getUniformInfo(SH_FRAGMENT_SHADER, uniformInfo);
>+    for (Vector<ANGLEUniformInfo>::iterator it = uniformInfo.begin(); it != uniformInfo.end(); ++it) {
>+        if (ANGLEWebKitBridge::isSamplerType((*it).type)) {
>+            // FIXME: For now, we restrict shaders with any sampler defined.
>+            // When we implement texture parameters, we will allow shaders whose samplers are bound to valid textures.
>+            // We must not allow OpenGL to give unbound samplers a default value of 0 because that references the DOM element texture,
>+            // which should be inaccessible to the author's shader code.
>+            // https://bugs.webkit.org/show_bug.cgi?id=96230
>+            return;
>+        }
>+    }
>+
>     // We need to add texture access, blending, and compositing code to shaders that are referenced from the CSS mix function.
>     if (programInfo.mixSettings().enabled) {
>         rewriteMixVertexShader();
>@@ -106,7 +121,7 @@ PassRefPtr<CustomFilterCompiledProgram> CustomFilterValidatedProgram::compiledPr
> {
>     ASSERT(m_isInitialized && m_globalContext && !m_validatedVertexShader.isNull() && !m_validatedFragmentShader.isNull());
>     if (!m_compiledProgram)
>-        m_compiledProgram = CustomFilterCompiledProgram::create(m_globalContext->context(), m_validatedVertexShader, m_validatedFragmentShader);
>+        m_compiledProgram = CustomFilterCompiledProgram::create(m_globalContext->context(), m_validatedVertexShader, m_validatedFragmentShader, m_programInfo.mixSettings().enabled);
>     return m_compiledProgram;
> }
> 
>diff --git a/Source/WebCore/platform/graphics/filters/FECustomFilter.cpp b/Source/WebCore/platform/graphics/filters/FECustomFilter.cpp
>index d65ff97..829bd9c 100644
>--- a/Source/WebCore/platform/graphics/filters/FECustomFilter.cpp
>+++ b/Source/WebCore/platform/graphics/filters/FECustomFilter.cpp
>@@ -329,6 +329,9 @@ void FECustomFilter::bindProgramAndBuffers(Uint8ClampedArray* srcPixelArray)
>     m_context->useProgram(m_compiledProgram->program());
>     
>     if (m_compiledProgram->samplerLocation() != -1) {
>+        // We should be binding the DOM element texture sampler only if the author is using the CSS mix function.
>+        ASSERT(m_validatedProgram->programInfo().mixSettings().enabled);
>+
>         m_context->activeTexture(GraphicsContext3D::TEXTURE0);
>         m_context->uniform1i(m_compiledProgram->samplerLocation(), 0);
> #if !PLATFORM(BLACKBERRY)

Actions: View | Formatted Diff | Diff

Attachments on bug 93871: 163154 | 163157 | 163251 | 163501 | 163649