Title: [271441] trunk
- Revision
- 271441
- Author
- [email protected]
- Date
- 2021-01-13 10:40:57 -0800 (Wed, 13 Jan 2021)
Log Message
Null check native image in createBitmapImageAfterScalingIfNeeded
https://bugs.webkit.org/show_bug.cgi?id=220348
Patch by Rob Buis <[email protected]> on 2021-01-13
Reviewed by Alex Christensen.
Source/WebCore:
Null check native image in createBitmapImageAfterScalingIfNeeded
as well as the result of sinkIntoImage.
Test: fast/css/border-image-scale-crash.html
* platform/graphics/GradientImage.cpp:
(WebCore::GradientImage::drawPattern):
* platform/graphics/cg/ImageBufferCGBackend.cpp:
(WebCore::createBitmapImageAfterScalingIfNeeded):
LayoutTests:
Add test for border-image with large scale factor.
* fast/css/border-image-scale-crash-expected.txt: Added.
* fast/css/border-image-scale-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (271440 => 271441)
--- trunk/LayoutTests/ChangeLog 2021-01-13 15:53:27 UTC (rev 271440)
+++ trunk/LayoutTests/ChangeLog 2021-01-13 18:40:57 UTC (rev 271441)
@@ -1,3 +1,15 @@
+2021-01-13 Rob Buis <[email protected]>
+
+ Null check native image in createBitmapImageAfterScalingIfNeeded
+ https://bugs.webkit.org/show_bug.cgi?id=220348
+
+ Reviewed by Alex Christensen.
+
+ Add test for border-image with large scale factor.
+
+ * fast/css/border-image-scale-crash-expected.txt: Added.
+ * fast/css/border-image-scale-crash.html: Added.
+
2021-01-13 Commit Queue <[email protected]>
Unreviewed, reverting r271401.
Added: trunk/LayoutTests/fast/css/border-image-scale-crash-expected.txt (0 => 271441)
--- trunk/LayoutTests/fast/css/border-image-scale-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/css/border-image-scale-crash-expected.txt 2021-01-13 18:40:57 UTC (rev 271441)
@@ -0,0 +1 @@
+This test should not crash
Added: trunk/LayoutTests/fast/css/border-image-scale-crash.html (0 => 271441)
--- trunk/LayoutTests/fast/css/border-image-scale-crash.html (rev 0)
+++ trunk/LayoutTests/fast/css/border-image-scale-crash.html 2021-01-13 18:40:57 UTC (rev 271441)
@@ -0,0 +1,9 @@
+<style>
+* { border-image: linear-gradient(to right, rgb(40,242,131), white) 12 3; transform: scale(55, -1); }
+</style>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+</script>
+<div style="border-image-repeat: round">This test should not crash</div>
+
Modified: trunk/Source/WebCore/ChangeLog (271440 => 271441)
--- trunk/Source/WebCore/ChangeLog 2021-01-13 15:53:27 UTC (rev 271440)
+++ trunk/Source/WebCore/ChangeLog 2021-01-13 18:40:57 UTC (rev 271441)
@@ -1,3 +1,20 @@
+2021-01-13 Rob Buis <[email protected]>
+
+ Null check native image in createBitmapImageAfterScalingIfNeeded
+ https://bugs.webkit.org/show_bug.cgi?id=220348
+
+ Reviewed by Alex Christensen.
+
+ Null check native image in createBitmapImageAfterScalingIfNeeded
+ as well as the result of sinkIntoImage.
+
+ Test: fast/css/border-image-scale-crash.html
+
+ * platform/graphics/GradientImage.cpp:
+ (WebCore::GradientImage::drawPattern):
+ * platform/graphics/cg/ImageBufferCGBackend.cpp:
+ (WebCore::createBitmapImageAfterScalingIfNeeded):
+
2021-01-13 Commit Queue <[email protected]>
Unreviewed, reverting r271401.
Modified: trunk/Source/WebCore/platform/graphics/GradientImage.cpp (271440 => 271441)
--- trunk/Source/WebCore/platform/graphics/GradientImage.cpp 2021-01-13 15:53:27 UTC (rev 271440)
+++ trunk/Source/WebCore/platform/graphics/GradientImage.cpp 2021-01-13 18:40:57 UTC (rev 271441)
@@ -87,6 +87,8 @@
imageBuffer->convertToLuminanceMask();
m_cachedImage = ImageBuffer::sinkIntoImage(WTFMove(imageBuffer), PreserveResolution::Yes);
+ if (!m_cachedImage)
+ return;
}
destContext.setDrawLuminanceMask(false);
Modified: trunk/Source/WebCore/platform/graphics/cg/ImageBufferCGBackend.cpp (271440 => 271441)
--- trunk/Source/WebCore/platform/graphics/cg/ImageBufferCGBackend.cpp 2021-01-13 15:53:27 UTC (rev 271440)
+++ trunk/Source/WebCore/platform/graphics/cg/ImageBufferCGBackend.cpp 2021-01-13 18:40:57 UTC (rev 271441)
@@ -92,6 +92,9 @@
static RefPtr<Image> createBitmapImageAfterScalingIfNeeded(RefPtr<NativeImage>&& image, const IntSize& logicalSize, const IntSize& backendSize, float resolutionScale, PreserveResolution preserveResolution)
{
+ if (!image)
+ return nullptr;
+
if (resolutionScale == 1 || preserveResolution == PreserveResolution::Yes)
image = NativeImage::create(createCroppedImageIfNecessary(image->platformImage().get(), backendSize));
else {
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
