tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

test_fuzzing_bugs.html (6189B)

      1 <!DOCTYPE HTML>
      2 <title>WebGL fuzzy bugs</title>
      3 <script src="/tests/SimpleTest/SimpleTest.js"></script>
      4 <link rel="stylesheet" href="/tests/SimpleTest/test.css">
      5 <script src="driver-info.js"></script>
      6 <script src="webgl-util.js"></script>
      7 <body>
      8 <script>
      9 
     10 // Test the framebufferTexture2D() call with a unbound texture.
     11 function framebufferTexture2D_bug1257593() {
     12  var canvas = document.createElement('canvas');
     13 
     14  var gl = null;
     15  gl = canvas.getContext('webgl') || canvas.getContext('experimental-webgl');
     16  if (!gl) {
     17    todo(false, 'WebGL framebufferTexture2D test, webgl is unavailable.');
     18    return;
     19  }
     20 
     21  var texture = gl.createTexture(); // only createTexture(), but no bindBuffer()
     22  gl.framebufferTexture2D(gl.FRAMEBUFFER, gl.STENCIL_ATTACHMENT, gl.TEXTURE_CUBE_MAP_NEGATIVE_Z, texture, 0);
     23 
     24  ok(true, 'WebGL framebufferTexture2D with unbound texture');
     25 }
     26 
     27 // Test to call ClearBufferXXX() during context lost.
     28 function webGL2ClearBufferXXX_bug1252414() {
     29  var canvas = document.createElement('canvas');
     30 
     31  var gl = canvas.getContext('webgl2');
     32  if (!gl) {
     33    todo(false, 'WebGL2 is not supported');
     34    return;
     35  }
     36 
     37  var ext = gl.getExtension('WEBGL_lose_context');
     38  if (!ext) {
     39    todo(false, 'WebGL ClearBufferXXX test, ext WEBGL_lose_context is unavailable.');
     40    return;
     41  }
     42 
     43  // Force to lose context.
     44  ext.loseContext();
     45 
     46  // Even thought the context is lost, all clearBuffer* function should still
     47  // work without crash.
     48  gl.clearBufferiv(gl.COLOR, 0, new Int32Array(10));
     49  gl.clearBufferuiv(gl.COLOR, 0, new Uint32Array(10));
     50  gl.clearBufferfv(gl.DEPTH, 0, new Float32Array(10));
     51  gl.clearBufferfi(gl.DEPTH_STENCIL, 0, 0.0, 0);
     52 
     53  ok(true, 'WebGL2 clearBufferXXX call during loseContext');
     54 }
     55 
     56 // Test gl function for multiple gl contexts switch.
     57 function getFramebufferAttachmentParameter_bug1267100()
     58 {
     59  var canvas1 = document.createElement('canvas');
     60  var canvas2 = document.createElement('canvas');
     61 
     62  var gl1 = null;
     63  gl1 = canvas1.getContext('webgl') || canvas1.getContext('experimental-webgl');
     64  if (!gl1) {
     65    todo(false, 'WebGL getFramebufferAttachmentParameter test, webgl is unavailable.');
     66    return;
     67  }
     68  var gl2 = null;
     69  gl2 = canvas2.getContext('webgl') || canvas2.getContext('experimental-webgl');
     70  if (!gl2) {
     71    todo(false, 'WebGL getFramebufferAttachmentParameter test, webgl is unavailable.');
     72    return;
     73  }
     74 
     75  gl1.bindFramebuffer(gl1.FRAMEBUFFER, gl1.createFramebuffer());
     76  gl2.scissor(0, 1, 2, 3);
     77  // The gl call should still work even though we use another gl context before.
     78  gl1.getFramebufferAttachmentParameter(gl1.FRAMEBUFFER,
     79                                        gl1.COLOR_ATTACHMENT0,
     80                                        gl1.FRAMEBUFFER_ATTACHMENT_OBJECT_NAME);
     81 
     82  ok(true, 'WebGL test getFramebufferAttachmentParameter');
     83 }
     84 
     85 // Test to call getFragDataLocation() when the fragment shader is detatched.
     86 function getFragDataLocation_bug1259702() {
     87  var canvas = document.createElement('canvas');
     88 
     89  var gl = canvas.getContext('webgl2');
     90 
     91  if (!gl) {
     92    todo(false, 'WebGL2 is not supported');
     93    return;
     94  }
     95 
     96  var program = gl.createProgram();
     97 
     98  var vertexShaderSrc =
     99    "void main(void) { \
    100       gl_Position = vec4(1.0, 1.0, 1.0, 1.0); \
    101    }";
    102  var fragmentShaderSrc =
    103    "void main(void) { \
    104       gl_FragColor = vec4(1.0, 1.0, 1.0, 1.0); \
    105    }";
    106 
    107  var vertexShader = gl.createShader(gl.VERTEX_SHADER);
    108  var fragmentShader = gl.createShader(gl.FRAGMENT_SHADER);
    109 
    110  gl.shaderSource(vertexShader, vertexShaderSrc);
    111  gl.compileShader(vertexShader);
    112  gl.attachShader(program, vertexShader);
    113 
    114  gl.shaderSource(fragmentShader, fragmentShaderSrc);
    115  gl.compileShader(fragmentShader);
    116  gl.attachShader(program, fragmentShader);
    117 
    118  gl.linkProgram(program);
    119  if (!gl.getProgramParameter(program, gl.LINK_STATUS)) {
    120    var lastError = gl.getProgramInfoLog(program);
    121    ok(false, 'WebGL getFragDataLocation() test, error in linking:' +
    122        lastError);
    123    return;
    124  }
    125 
    126  gl.useProgram(program);
    127 
    128  gl.detachShader(program, fragmentShader);
    129  // Test the getFragDataLocation() call after detatch the shader.
    130  // This call should not hit crash.
    131  gl.getFragDataLocation(program, "foobar");
    132 
    133  ok(true, 'WebGL getFragDataLocation() call after detatch fragment shader');
    134 }
    135 
    136 function deleteBuffer_bug1379995()
    137 {
    138  var canvas = document.createElement('canvas');
    139  var gl = null;
    140  gl = canvas.getContext('webgl') || canvas.getContext('experimental-webgl');
    141  if (!gl) {
    142    todo(false, 'WebGL deleteBuffer test, webgl is unavailable.');
    143    return;
    144  }
    145 
    146  var program = gl.createProgram();
    147  var vShader = gl.createShader(gl.VERTEX_SHADER);
    148  var fShader = gl.createShader(gl.FRAGMENT_SHADER);
    149  gl.shaderSource(vShader,'attribute vec3 pos;void main(){gl_Position = vec4(pos, 2.0);}');
    150  gl.shaderSource(fShader,'void main() {gl_FragColor = vec4(0.5, 0.5, 1.0, 1.0);}');
    151  gl.compileShader(vShader);
    152  gl.compileShader(fShader);
    153  gl.attachShader(program, vShader);
    154  gl.attachShader(program, fShader);
    155  gl.linkProgram(program);
    156  var buffer = gl.createBuffer();
    157  var attr = gl.getAttribLocation(program, 'pos');
    158  gl.bindBuffer(gl.ARRAY_BUFFER, buffer);
    159  gl.enableVertexAttribArray(attr);
    160  gl.bufferData(gl.ARRAY_BUFFER, new Float32Array([-1, 0, 0,0, 1, 0,0, -1, 0,1, 0, 0]),gl.STATIC_DRAW);
    161  gl.useProgram(program);
    162  gl.vertexAttribPointer(attr, 3, gl.FLOAT, false, 0, 0);
    163  gl.drawArrays(gl.TRIANGLES, 0, 3);
    164  gl.deleteBuffer(buffer);
    165  // Call the drawArrays after deleteBuffer(). It should not hit the crash.
    166  gl.drawArrays(gl.TRIANGLES, 0, 3);
    167 
    168  ok(true, 'WebGL no crash for drawArrays() after deleteBuffer() call');
    169 }
    170 
    171 function run() {
    172  webGL2ClearBufferXXX_bug1252414();
    173  framebufferTexture2D_bug1257593();
    174  getFramebufferAttachmentParameter_bug1267100();
    175  getFragDataLocation_bug1259702();
    176  deleteBuffer_bug1379995();
    177 
    178  SimpleTest.finish();
    179 }
    180 
    181 SimpleTest.waitForExplicitFinish();
    182 
    183 try {
    184  var prefArrArr = [
    185    ['webgl.force-enabled', true],
    186    ['webgl.enable-webgl2', true],
    187  ];
    188  var prefEnv = {'set': prefArrArr};
    189  SpecialPowers.pushPrefEnv(prefEnv, run);
    190 } catch (e) {
    191  warning('No SpecialPowers, but trying WebGL2 anyway...');
    192  run();
    193 }
    194 </script>