Attachment #441840 for bug #231794

View Details Raw Unified Return to Bug 231794

| Differences between



2021-10-19  John Cunningham  <johncunningham@apple.com>

        Avoid null pointer dereference when creating ImageBitmap from a null image.
        https://bugs.webkit.org/show_bug.cgi?id=231794

        Reviewed by Said Abou-Hallawa.

        If the image is null, we can reject the promise earlier. Default to sRGB when a
        BitmapImage's nativeImage is null.

        Test: fast/canvas/createImageBitmap-invalid-image-blob-crash.html

        * html/ImageBitmap.cpp:
        (WebCore::ImageBitmap::createFromBuffer):
        * platform/graphics/BitmapImage.cpp:
        (WebCore::BitmapImage::colorSpace):

2021-10-15  Antti Koivisto  <antti@apple.com>

        [LFC][Integration] Factor line logical order traversal out of iterator

Lines 749-755 void ImageBitmap::createFromBuffer(ScriptExecutionContext& scriptExecutionContex a/Source/WebCore/html/ImageBitmap.cpp_sec1
- a/Source/WebCore/html/ImageBitmap.cpp -1 / +1 lines
749	auto observer = ImageBitmapImageObserver::create(mimeType, expectedContentLength, sourceURL);	749	auto observer = ImageBitmapImageObserver::create(mimeType, expectedContentLength, sourceURL);
750	auto image = BitmapImage::create(observer.ptr());	750	auto image = BitmapImage::create(observer.ptr());
751	auto result = image->setData(sharedBuffer.copyRef(), true);	751	auto result = image->setData(sharedBuffer.copyRef(), true);
752	if (result != EncodedDataStatus::Complete) {	752	if (result != EncodedDataStatus::Complete \|\| image->isNull()) {
753	promise.reject(InvalidStateError, "Cannot decode the data in the argument to createImageBitmap");	753	promise.reject(InvalidStateError, "Cannot decode the data in the argument to createImageBitmap");
754	return;	754	return;
755	}	755	}

Lines 659-665 void BitmapImage::imageFrameAvailableAtIndex(size_t index) a/Source/WebCore/platform/graphics/BitmapImage.cpp_sec1
- a/Source/WebCore/platform/graphics/BitmapImage.cpp -1 / +3 lines
659		659
660	DestinationColorSpace BitmapImage::colorSpace()	660	DestinationColorSpace BitmapImage::colorSpace()
661	{	661	{
662	return nativeImage()->colorSpace();	662	if (auto nativeImage = this->nativeImage())
		663	return nativeImage->colorSpace();
		664	return DestinationColorSpace::SRGB();
663	}	665	}
664		666
665	unsigned BitmapImage::decodeCountForTesting() const	667	unsigned BitmapImage::decodeCountForTesting() const



2021-10-19  John Cunningham  <johncunningham@apple.com>

        Avoid null pointer dereference when creating ImageBitmap from a null image.
        https://bugs.webkit.org/show_bug.cgi?id=231794

        Reviewed by Said Abou-Hallawa.

        If the image is null, we can reject the promise earlier. Default to sRGB when a
        BitmapImage's nativeImage is null.

        * fast/canvas/createImageBitmap-invalid-image-blob-crash-expected.txt: Added.
        * fast/canvas/createImageBitmap-invalid-image-blob-crash.html: Added.

2021-10-15  Robert Jenner  <Jenner@apple.com>

        REBASELINE 2 tables/mozilla tests failing constantly

Line 0 a/LayoutTests/fast/canvas/createImageBitmap-invalid-image-blob-crash-expected.txt_sec1
- a/LayoutTests/fast/canvas/createImageBitmap-invalid-image-blob-crash-expected.txt +5 lines
	1	PASSED (If this page did not crash.)
	2	PASS successfullyParsed is true
	3
	4	TEST COMPLETE
	5



<html>
<head>
<script src="../../resources/js-test-pre.js"></script>
<script>
function runTest() {
    // A valid PNG header with no additional data for an image.
    let pngHeaderData = new Uint8Array([0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A, 0x00, 0x00]);
    let pngHeader = new File([pngHeaderData], '');
    createImageBitmap(pngHeader, {resizeWidth: 1, resizeHeight: 1});
}
</script>
</head>
<body onload="runTest()">
    <canvas id="test" width="1000" height="1000"></canvas>
PASSED (If this page did not crash.)
    <pre id='console'></pre>
    <script src="../../resources/js-test-post.js"></script>
</body>
</html>

Return to Bug 231794

Lines 1-3 a/Source/WebCore/ChangeLog_sec1
- a/Source/WebCore/ChangeLog +17 lines
		1	2021-10-19 John Cunningham <johncunningham@apple.com>
		2
		3	Avoid null pointer dereference when creating ImageBitmap from a null image.
		4	https://bugs.webkit.org/show_bug.cgi?id=231794
		5
		6	Reviewed by Said Abou-Hallawa.
		7
		8	If the image is null, we can reject the promise earlier. Default to sRGB when a
		9	BitmapImage's nativeImage is null.
		10
		11	Test: fast/canvas/createImageBitmap-invalid-image-blob-crash.html
		12
		13	* html/ImageBitmap.cpp:
		14	(WebCore::ImageBitmap::createFromBuffer):
		15	* platform/graphics/BitmapImage.cpp:
		16	(WebCore::BitmapImage::colorSpace):
		17
1	2021-10-15 Antti Koivisto <antti@apple.com>	18	2021-10-15 Antti Koivisto <antti@apple.com>
2		19
3	[LFC][Integration] Factor line logical order traversal out of iterator	20	[LFC][Integration] Factor line logical order traversal out of iterator

Lines 1-3 a/LayoutTests/ChangeLog_sec1
- a/LayoutTests/ChangeLog +13 lines
		1	2021-10-19 John Cunningham <johncunningham@apple.com>
		2
		3	Avoid null pointer dereference when creating ImageBitmap from a null image.
		4	https://bugs.webkit.org/show_bug.cgi?id=231794
		5
		6	Reviewed by Said Abou-Hallawa.
		7
		8	If the image is null, we can reject the promise earlier. Default to sRGB when a
		9	BitmapImage's nativeImage is null.
		10
		11	* fast/canvas/createImageBitmap-invalid-image-blob-crash-expected.txt: Added.
		12	* fast/canvas/createImageBitmap-invalid-image-blob-crash.html: Added.
		13
1	2021-10-15 Robert Jenner <Jenner@apple.com>	14	2021-10-15 Robert Jenner <Jenner@apple.com>
2		15
3	REBASELINE 2 tables/mozilla tests failing constantly	16	REBASELINE 2 tables/mozilla tests failing constantly

Line 0 a/LayoutTests/fast/canvas/createImageBitmap-invalid-image-blob-crash.html_sec1
- a/LayoutTests/fast/canvas/createImageBitmap-invalid-image-blob-crash.html +19 lines
	1	<html>
	2	<head>
	3	<script src="../../resources/js-test-pre.js"></script>
	4	<script>
	5	function runTest() {
	6	// A valid PNG header with no additional data for an image.
	7	let pngHeaderData = new Uint8Array([0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A, 0x00, 0x00]);
	8	let pngHeader = new File([pngHeaderData], '');
	9	createImageBitmap(pngHeader, {resizeWidth: 1, resizeHeight: 1});
	10	}
	11	</script>
	12	</head>
	13	<body onload="runTest()">
	14	<canvas id="test" width="1000" height="1000"></canvas>
	15	PASSED (If this page did not crash.)
	16	<pre id='console'></pre>
	17	<script src="../../resources/js-test-post.js"></script>
	18	</body>
	19	</html>