Attachment 372651 Details for Bug 198775 – patch for landing

[patch] patch for landing

b-backup.diff (text/plain), 8.15 KB, created by Saam Barati on 2019-06-21 14:31:00 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Saam Barati

Created: 2019-06-21 14:31:00 PDT

Size: 8.15 KB

patch

obsolete

>Index: Source/WebCore/ChangeLog
>===================================================================
>--- Source/WebCore/ChangeLog	(revision 246697)
>+++ Source/WebCore/ChangeLog	(working copy)
>@@ -1,3 +1,21 @@
>+2019-06-21  Saam Barati  <sbarati@apple.com>
>+
>+        [WHLSL] Code that accesses an undefined variable crashes
>+        https://bugs.webkit.org/show_bug.cgi?id=198775
>+
>+        Reviewed by Myles C. Maxfield.
>+
>+        Myles mostly fixed this in r246631 when he made NameResolver propagate
>+        its error to its parent NameResolver. However, there was still one bug
>+        where we ended up calling setError twice for an if statement. This patch
>+        fixes that and adds tests.
>+
>+        Tests: webgpu/whlsl-use-undefined-variable-2.html
>+               webgpu/whlsl-use-undefined-variable.html
>+
>+        * Modules/webgpu/WHLSL/WHLSLNameResolver.cpp:
>+        (WebCore::WHLSL::NameResolver::visit):
>+
> 2019-06-21  Tim Horton  <timothy_horton@apple.com>
> 
>         Preview of <picture> element doesn't match element bounds
>Index: Source/WebCore/Modules/webgpu/WHLSL/WHLSLNameResolver.cpp
>===================================================================
>--- Source/WebCore/Modules/webgpu/WHLSL/WHLSLNameResolver.cpp	(revision 246686)
>+++ Source/WebCore/Modules/webgpu/WHLSL/WHLSLNameResolver.cpp	(working copy)
>@@ -120,12 +120,18 @@ void NameResolver::visit(AST::Block& blo
> void NameResolver::visit(AST::IfStatement& ifStatement)
> {
>     checkErrorAndVisit(ifStatement.conditional());
>-    NameContext nameContext(&m_nameContext);
>-    NameResolver newNameResolver(*this, nameContext);
>-    newNameResolver.checkErrorAndVisit(ifStatement.body());
>-    if (newNameResolver.error())
>-        setError();
>-    else if (ifStatement.elseBody()) {
>+    if (error())
>+        return;
>+
>+    {
>+        NameContext nameContext(&m_nameContext);
>+        NameResolver newNameResolver(*this, nameContext);
>+        newNameResolver.checkErrorAndVisit(ifStatement.body());
>+    }
>+    if (error())
>+        return;
>+
>+    if (ifStatement.elseBody()) {
>         NameContext nameContext(&m_nameContext);
>         NameResolver newNameResolver(*this, nameContext);
>         newNameResolver.checkErrorAndVisit(*ifStatement.elseBody());
>@@ -135,6 +141,9 @@ void NameResolver::visit(AST::IfStatemen
> void NameResolver::visit(AST::WhileLoop& whileLoop)
> {
>     checkErrorAndVisit(whileLoop.conditional());
>+    if (error())
>+        return;
>+
>     NameContext nameContext(&m_nameContext);
>     NameResolver newNameResolver(*this, nameContext);
>     newNameResolver.checkErrorAndVisit(whileLoop.body());
>@@ -142,9 +151,12 @@ void NameResolver::visit(AST::WhileLoop&
> 
> void NameResolver::visit(AST::DoWhileLoop& whileLoop)
> {
>-    NameContext nameContext(&m_nameContext);
>-    NameResolver newNameResolver(*this, nameContext);
>-    newNameResolver.checkErrorAndVisit(whileLoop.body());
>+    {
>+        NameContext nameContext(&m_nameContext);
>+        NameResolver newNameResolver(*this, nameContext);
>+        newNameResolver.checkErrorAndVisit(whileLoop.body());
>+    }
>+
>     checkErrorAndVisit(whileLoop.conditional());
> }
> 
>Index: LayoutTests/ChangeLog
>===================================================================
>--- LayoutTests/ChangeLog	(revision 246686)
>+++ LayoutTests/ChangeLog	(working copy)
>@@ -1,3 +1,15 @@
>+2019-06-21  Saam Barati  <sbarati@apple.com>
>+
>+        [WHLSL] Code that accesses an undefined variable crashes
>+        https://bugs.webkit.org/show_bug.cgi?id=198775
>+
>+        Reviewed by Myles C. Maxfield.
>+
>+        * webgpu/whlsl-use-undefined-variable-2-expected.txt: Added.
>+        * webgpu/whlsl-use-undefined-variable-2.html: Added.
>+        * webgpu/whlsl-use-undefined-variable-expected.txt: Added.
>+        * webgpu/whlsl-use-undefined-variable.html: Added.
>+
> 2019-06-21  Youenn Fablet  <youenn@apple.com>
> 
>         Safari crashes after ~2028 OfflineAudioContext objects are created (they never get garbage collected, consuming a thread each)
>Index: LayoutTests/webgpu/whlsl-use-undefined-variable-2-expected.txt
>===================================================================
>--- LayoutTests/webgpu/whlsl-use-undefined-variable-2-expected.txt	(nonexistent)
>+++ LayoutTests/webgpu/whlsl-use-undefined-variable-2-expected.txt	(working copy)
>@@ -0,0 +1,5 @@
>+PASS Should not crash.
>+PASS successfullyParsed is true
>+
>+TEST COMPLETE
>+
>Index: LayoutTests/webgpu/whlsl-use-undefined-variable-2.html
>===================================================================
>--- LayoutTests/webgpu/whlsl-use-undefined-variable-2.html	(nonexistent)
>+++ LayoutTests/webgpu/whlsl-use-undefined-variable-2.html	(working copy)
>@@ -0,0 +1,43 @@
>+<!DOCTYPE html>
>+<html>
>+<head>
>+<script src="../resources/js-test-pre.js"></script>
>+</head>
>+<body>
>+<script>
>+const shaderSource = `
>+[numthreads(1, 1, 1)]
>+compute void computeShader(device float[] buffer : register(u0), float3 threadID : SV_DispatchThreadID) {
>+    float4 vec = float4(x,x,x,x);
>+}
>+`;
>+let resultsFloat32Array;
>+async function start() {
>+    const adapter = await navigator.gpu.requestAdapter();
>+    const device = await adapter.requestDevice();
>+
>+    const shaderModule = device.createShaderModule({code: shaderSource, isWHLSL: true});
>+    const computeStage = {module: shaderModule, entryPoint: "computeShader"};
>+
>+    const bindGroupLayoutDescriptor = {bindings: [{binding: 0, visibility: 7, type: "storage-buffer"}]};
>+    const bindGroupLayout = device.createBindGroupLayout(bindGroupLayoutDescriptor);
>+    const pipelineLayoutDescriptor = {bindGroupLayouts: [bindGroupLayout]};
>+    const pipelineLayout = device.createPipelineLayout(pipelineLayoutDescriptor);
>+
>+    const computePipelineDescriptor = {computeStage, layout: pipelineLayout};
>+    const computePipeline = device.createComputePipeline(computePipelineDescriptor);
>+
>+    testPassed("Should not crash.");
>+}
>+window.jsTestIsAsync = true;
>+window.addEventListener("load", function() {
>+    start().then(function() {
>+        finishJSTest();
>+    }, function() {
>+        finishJSTest();
>+    });
>+});
>+</script>
>+<script src="../resources/js-test-post.js"></script>
>+</body>
>+</html>
>Index: LayoutTests/webgpu/whlsl-use-undefined-variable-expected.txt
>===================================================================
>--- LayoutTests/webgpu/whlsl-use-undefined-variable-expected.txt	(nonexistent)
>+++ LayoutTests/webgpu/whlsl-use-undefined-variable-expected.txt	(working copy)
>@@ -0,0 +1,5 @@
>+PASS Should not crash.
>+PASS successfullyParsed is true
>+
>+TEST COMPLETE
>+
>Index: LayoutTests/webgpu/whlsl-use-undefined-variable.html
>===================================================================
>--- LayoutTests/webgpu/whlsl-use-undefined-variable.html	(nonexistent)
>+++ LayoutTests/webgpu/whlsl-use-undefined-variable.html	(working copy)
>@@ -0,0 +1,46 @@
>+<!DOCTYPE html>
>+<html>
>+<head>
>+<script src="../resources/js-test-pre.js"></script>
>+</head>
>+<body>
>+<script>
>+const shaderSource = `
>+[numthreads(1, 1, 1)]
>+compute void computeShader(device float[] buffer : register(u0), float3 threadID : SV_DispatchThreadID) {
>+    float foo;
>+    if (foo) {
>+        x = x + 1;
>+    }
>+}
>+`;
>+let resultsFloat32Array;
>+async function start() {
>+    const adapter = await navigator.gpu.requestAdapter();
>+    const device = await adapter.requestDevice();
>+
>+    const shaderModule = device.createShaderModule({code: shaderSource, isWHLSL: true});
>+    const computeStage = {module: shaderModule, entryPoint: "computeShader"};
>+
>+    const bindGroupLayoutDescriptor = {bindings: [{binding: 0, visibility: 7, type: "storage-buffer"}]};
>+    const bindGroupLayout = device.createBindGroupLayout(bindGroupLayoutDescriptor);
>+    const pipelineLayoutDescriptor = {bindGroupLayouts: [bindGroupLayout]};
>+    const pipelineLayout = device.createPipelineLayout(pipelineLayoutDescriptor);
>+
>+    const computePipelineDescriptor = {computeStage, layout: pipelineLayout};
>+    const computePipeline = device.createComputePipeline(computePipelineDescriptor);
>+
>+    testPassed("Should not crash.");
>+}
>+window.jsTestIsAsync = true;
>+window.addEventListener("load", function() {
>+    start().then(function() {
>+        finishJSTest();
>+    }, function() {
>+        finishJSTest();
>+    });
>+});
>+</script>
>+<script src="../resources/js-test-post.js"></script>
>+</body>
>+</html>

Actions: View | Formatted Diff | Diff

Attachments on bug 198775: 372593 | 372651