[webkit-changes] [145654] branches/safari-536.30-branch

Tue, 12 Mar 2013 18:19:06 -0700

Title: [145654] branches/safari-536.30-branch

Diff

Modified: branches/safari-536.30-branch/LayoutTests/ChangeLog (145653 => 145654)


--- branches/safari-536.30-branch/LayoutTests/ChangeLog	2013-03-13 01:20:51 UTC (rev 145653)
+++ branches/safari-536.30-branch/LayoutTests/ChangeLog	2013-03-13 01:21:02 UTC (rev 145654)
@@ -1,5 +1,23 @@
 2013-03-12  Lucas Forschler  <lforsch...@apple.com>
 
+        Merge r138994
+
+    2013-01-07  Justin Novosad  <ju...@google.com>
+
+            Fixing memory read after free in CanvasRenderingContext2D::accessFont
+            https://bugs.webkit.org/show_bug.cgi?id=106244
+
+            Reviewed by Abhishek Arya.
+
+            New test case to verify stability of 2D canvas method measureText.
+            Test case was causing a DumpRenderTree crash on builds with
+            AddressSantitizer instrumentation.
+
+            * fast/canvas/canvas-measureText-expected.txt: Added.
+            * fast/canvas/canvas-measureText.html: Added.
+
+2013-03-12  Lucas Forschler  <lforsch...@apple.com>
+
         Merge r138926
 
     2013-01-06  Abhishek Arya  <infe...@chromium.org>

Copied: branches/safari-536.30-branch/LayoutTests/fast/canvas/canvas-measureText-expected.txt (from rev 138994, trunk/LayoutTests/fast/canvas/canvas-measureText-expected.txt) (0 => 145654)


--- branches/safari-536.30-branch/LayoutTests/fast/canvas/canvas-measureText-expected.txt	                        (rev 0)
+++ branches/safari-536.30-branch/LayoutTests/fast/canvas/canvas-measureText-expected.txt	2013-03-13 01:21:02 UTC (rev 145654)
@@ -0,0 +1,5 @@
+Regression test for bug 106244
+
+Test passes by not crashing.
+
+

Copied: branches/safari-536.30-branch/LayoutTests/fast/canvas/canvas-measureText.html (from rev 138994, trunk/LayoutTests/fast/canvas/canvas-measureText.html) (0 => 145654)


--- branches/safari-536.30-branch/LayoutTests/fast/canvas/canvas-measureText.html	                        (rev 0)
+++ branches/safari-536.30-branch/LayoutTests/fast/canvas/canvas-measureText.html	2013-03-13 01:21:02 UTC (rev 145654)
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<body>
+<p>Regression test for bug <a href=""
+<p>Test passes by not crashing.</p>
+<canvas id="test"></canvas>
+</body>
+<script>
+if (window.testRunner)
+   testRunner.dumpAsText();
+
+var canvas = document.getElementById("test");
+var context = canvas.getContext("2d");
+for (x = 0; x < 100; x++) {
+     context.restore();
+     context.save();
+     context.save();
+     context.measureText("a", 0, 0, 0);
+}
+</script>
+</html>

Modified: branches/safari-536.30-branch/Source/WebCore/ChangeLog (145653 => 145654)


--- branches/safari-536.30-branch/Source/WebCore/ChangeLog	2013-03-13 01:20:51 UTC (rev 145653)
+++ branches/safari-536.30-branch/Source/WebCore/ChangeLog	2013-03-13 01:21:02 UTC (rev 145654)
@@ -1,5 +1,24 @@
 2013-03-12  Lucas Forschler  <lforsch...@apple.com>
 
+        Merge r138994
+
+    2013-01-07  Justin Novosad  <ju...@google.com>
+
+            Fixing memory read after free in CanvasRenderingContext2D::accessFont
+            https://bugs.webkit.org/show_bug.cgi?id=106244
+
+            Reviewed by Abhishek Arya.
+
+            Using a temporary String object to hold ref count on string that is
+            passed by reference in CanvasRenderingContext2D::accessFont.
+
+            Test: fast/canvas/canvas-measureText.html
+
+            * html/canvas/CanvasRenderingContext2D.cpp:
+            (WebCore::CanvasRenderingContext2D::accessFont):
+
+2013-03-12  Lucas Forschler  <lforsch...@apple.com>
+
         Merge r138926
 
     2013-01-06  Abhishek Arya  <infe...@chromium.org>

Modified: branches/safari-536.30-branch/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp (145653 => 145654)


--- branches/safari-536.30-branch/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp	2013-03-13 01:20:51 UTC (rev 145653)
+++ branches/safari-536.30-branch/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp	2013-03-13 01:21:02 UTC (rev 145654)
@@ -2188,8 +2188,13 @@
 {
     canvas()->document()->updateStyleIfNeeded();
 
-    if (!state().m_realizedFont)
-        setFont(state().m_unparsedFont);
+    if (!state().m_realizedFont) {
+        // Create temporary string object to hold ref count in case
+        // state().m_unparsedFont in unreffed by call to realizeSaves in
+        // setFont.
+        String unparsedFont(state().m_unparsedFont);
+        setFont(unparsedFont);
+    }
     return state().m_font;
 }
 

_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to