Bug 866575: Throw when creating a pattern with a large source r=nrc, mattwoodrow

This commit is contained in:
David Zbarsky 2013-05-01 22:04:08 -04:00
parent d54726c936
commit 8cde3feac3
4 changed files with 39 additions and 0 deletions

View File

@ -1455,6 +1455,7 @@ CanvasRenderingContext2D::CreatePattern(const HTMLImageOrCanvasOrVideoElement& e
// Ignore nullptr cairo surfaces! See bug 666312.
if (!res.mSurface->CairoSurface() || res.mSurface->CairoStatus()) {
error.Throw(NS_ERROR_NOT_AVAILABLE);
return nullptr;
}

View File

@ -106,6 +106,7 @@ MOCHITEST_FILES = \
test_bug753758.html \
test_bug764125.html \
test_bug856472.html \
test_bug866575.html \
test_drawImage_edge_cases.html \
test_drawImage_document_domain.html \
test_mozDashOffset.html \

View File

@ -0,0 +1,34 @@
<!DOCTYPE HTML>
<html>
<!--
https://bugzilla.mozilla.org/show_bug.cgi?id=866575
-->
<head>
<title>Test for Bug 866575</title>
<script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
</head>
<body>
<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=866575">Mozilla Bug 866575</a>
<p id="display"></p>
<div id="content" style="display: none">
</div>
<pre id="test">
<script>
/** Test for Bug 866575 **/
var canvas1 = document.createElementNS('http://www.w3.org/1999/xhtml', 'canvas');
canvas1.width = "306368";
var canvas2 = document.createElementNS('http://www.w3.org/1999/xhtml', 'canvas');
try {
canvas2.getContext('2d').createPattern(canvas1, 'repeat-x');
} catch (e) {}
finally {
ok(true, "Didn't crash");
}
</script>
</pre>
</body>
</html>

View File

@ -4654,6 +4654,9 @@ nsLayoutUtils::SurfaceFromElement(HTMLCanvasElement* aElement,
surf = gfxPlatform::GetPlatform()->CreateOffscreenSurface(size, gfxASurface::CONTENT_COLOR_ALPHA);
}
if (!surf)
return result;
nsRefPtr<gfxContext> ctx = new gfxContext(surf);
// XXX shouldn't use the external interface, but maybe we can layerify this
uint32_t flags = premultAlpha ? HTMLCanvasElement::RenderFlagPremultAlpha : 0;