[webkit-changes] [WebKit/WebKit] 491458: WebGL DEPTH and STENCIL_ATTACHMENT overwrite delet...

[Kimmo Kinnunen]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 491458f894ee187a16daa0824656b2752ce614a6
      https://github.com/WebKit/WebKit/commit/491458f894ee187a16daa0824656b2752ce614a6
  Author: Kimmo Kinnunen <kkinnunen at apple.com>
  Date:   2023-08-29 (Tue, 29 Aug 2023)

  Changed paths:
    M LayoutTests/webgl/resources/webgl_test_files/conformance2/renderbuffers/framebuffer-object-attachment.html
    M Source/WebCore/html/canvas/WebGLFramebuffer.cpp
    M Source/WebCore/html/canvas/WebGLFramebuffer.h
    M Source/WebCore/html/canvas/WebGLObject.cpp
    M Source/WebCore/html/canvas/WebGLObject.h

  Log Message:
  -----------
  WebGL DEPTH and STENCIL_ATTACHMENT overwrite deletes DEPTH_STENCIL_ATTACHMENT object prematurely
https://bugs.webkit.org/show_bug.cgi?id=260606
rdar://problem/114317226

Reviewed by Dan Glastonbury.

In WebGL2, DEPTH_STENCIL_ATTACHMENT attachment point is simulated
and changes DEPTH_ATTACHMENT and STENCIL_ATTACHMENT.
WebGLFramebuffer would store the attachment to
 - DEPTH_STENCIL_ATTACHMENT
 - DEPTH_ATTACHMENT
 - STENCIL_ATTACHMENT
However, it would call onAttached() only for the first one.
If the attachments would be modified with DEPTH_ATTACHMENT
or STENCIL_ATTACHMENT, the modification would result in
onDetached for these modifications. This imbalance of attach/detach
would leave the attachment counters inconsistent.

The bug would be observable when attaching a renderbuffer or texture and
then deleting it (orphaning). In this case the imbalanced detach would
delete the object, and queries about the object name through the framebuffer
attachment point would return "not found", since the object was really
deleted and not only orphaned.

* LayoutTests/webgl/resources/webgl_test_files/conformance2/renderbuffers/framebuffer-object-attachment.html:
This will be upstreamed to the CTS later.
Test that DEPTH_STENCIL_ATTACHMENT behavior with normal buffers are
the same as with orphaned buffers.

* Source/WebCore/html/canvas/WebGLFramebuffer.cpp:
(WebCore::WebGLFramebuffer::setAttachmentForBoundFramebuffer):
(WebCore::WebGLFramebuffer::removeAttachmentFromBoundFramebuffer):
(WebCore::WebGLFramebuffer::setAttachmentInternal):
(WebCore::WebGLFramebuffer::removeAttachmentInternal):
(WebCore::WebGLFramebuffer::hasStencilBuffer const): Deleted.
Delete unused function.

* Source/WebCore/html/canvas/WebGLFramebuffer.h:
* Source/WebCore/html/canvas/WebGLObject.cpp:
(WebCore::WebGLObject::onDetached):
(WebCore::WebGLObject::detach): Deleted.
Delete unused function.

* Source/WebCore/html/canvas/WebGLObject.h:

Canonical link: https://commits.webkit.org/267422@main