Bug 1651419 - Check `img1/img2` for NULL before dereferencing them in nsDOMWindowUtils::CompareCanvases(). r=bas,alchen
authorAlexey Izbyshev <izbyshev@ispras.ru>
Wed, 10 Feb 2021 21:46:42 +0000
changeset 566882 52e0bdf9460f27b865cbea2e2959869b52ccce90
parent 566881 a3e891811b75d37034f7ab0446b3a510f083223f
child 566883 d691d9c9366a712cf114c728f6a01475430c960d
push id38191
push userbtara@mozilla.com
push dateThu, 11 Feb 2021 05:02:45 +0000
treeherdermozilla-central@5cbcb80f72bd [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbas, alchen
bugs1651419
milestone87.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1651419 - Check `img1/img2` for NULL before dereferencing them in nsDOMWindowUtils::CompareCanvases(). r=bas,alchen Differential Revision: https://phabricator.services.mozilla.com/D83141
dom/base/nsDOMWindowUtils.cpp
--- a/dom/base/nsDOMWindowUtils.cpp
+++ b/dom/base/nsDOMWindowUtils.cpp
@@ -1358,26 +1358,30 @@ nsDOMWindowUtils::CompareCanvases(nsISup
 
   if (!canvas1 || !canvas2) {
     return NS_ERROR_FAILURE;
   }
 
   RefPtr<DataSourceSurface> img1 = CanvasToDataSourceSurface(canvas1);
   RefPtr<DataSourceSurface> img2 = CanvasToDataSourceSurface(canvas2);
 
+  if (img1 == nullptr || img2 == nullptr ||
+      img1->GetSize() != img2->GetSize()) {
+    return NS_ERROR_FAILURE;
+  }
+
   if (img1->Equals(img2)) {
     // They point to the same underlying content.
     return NS_OK;
   }
 
   DataSourceSurface::ScopedMap map1(img1, DataSourceSurface::READ);
   DataSourceSurface::ScopedMap map2(img2, DataSourceSurface::READ);
 
-  if (img1 == nullptr || img2 == nullptr || !map1.IsMapped() ||
-      !map2.IsMapped() || img1->GetSize() != img2->GetSize() ||
+  if (!map1.IsMapped() || !map2.IsMapped() ||
       map1.GetStride() != map2.GetStride()) {
     return NS_ERROR_FAILURE;
   }
 
   int v;
   IntSize size = img1->GetSize();
   int32_t stride = map1.GetStride();