Bug 866575: Throw when creating a pattern with a large source r=nrc, mattwoodrow
authorDavid Zbarsky <dzbarsky@gmail.com>
Wed, 01 May 2013 22:04:08 -0400
changeset 141514 1edc14e711676f65de9920b262ffe7ba312c5895
parent 141513 7d40860eed2a209a069552011d5bc13e024748e5
child 141515 e827737f54a739e85f8cbdd0e72c44eb81967549
push id2579
push userakeybl@mozilla.com
push dateMon, 24 Jun 2013 18:52:47 +0000
treeherdermozilla-beta@b69b7de8a05a [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersnrc, mattwoodrow
bugs866575
milestone23.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 866575: Throw when creating a pattern with a large source r=nrc, mattwoodrow
content/canvas/src/CanvasRenderingContext2D.cpp
content/canvas/test/Makefile.in
content/canvas/test/test_bug866575.html
layout/base/nsLayoutUtils.cpp
--- a/content/canvas/src/CanvasRenderingContext2D.cpp
+++ b/content/canvas/src/CanvasRenderingContext2D.cpp
@@ -1450,16 +1450,17 @@ CanvasRenderingContext2D::CreatePattern(
 
   if (!res.mSurface) {
     error.Throw(NS_ERROR_NOT_AVAILABLE);
     return nullptr;
   }
 
   // Ignore nullptr cairo surfaces! See bug 666312.
   if (!res.mSurface->CairoSurface() || res.mSurface->CairoStatus()) {
+    error.Throw(NS_ERROR_NOT_AVAILABLE);
     return nullptr;
   }
 
   EnsureTarget();
   RefPtr<SourceSurface> srcSurf =
     gfxPlatform::GetPlatform()->GetSourceSurfaceForSurface(mTarget, res.mSurface);
 
   nsRefPtr<CanvasPattern> pat =
--- a/content/canvas/test/Makefile.in
+++ b/content/canvas/test/Makefile.in
@@ -101,16 +101,17 @@ MOCHITEST_FILES = \
 	test_toDataURL_lowercase_ascii.html \
 	test_toDataURL_parameters.html \
 	test_mozGetAsFile.html \
 	test_canvas_strokeStyle_getter.html \
 	test_bug613794.html \
 	test_bug753758.html \
 	test_bug764125.html \
 	test_bug856472.html \
+	test_bug866575.html \
 	test_drawImage_edge_cases.html \
 	test_drawImage_document_domain.html \
   test_mozDashOffset.html \
 	file_drawImage_document_domain.html \
 	$(NULL)
 
 ifneq (1_Linux,$(MOZ_SUITE)_$(OS_ARCH))
 # This test fails in Suite on Linux for some reason, disable it there
new file mode 100644
--- /dev/null
+++ b/content/canvas/test/test_bug866575.html
@@ -0,0 +1,34 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=866575
+-->
+<head>
+  <title>Test for Bug 866575</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=866575">Mozilla Bug 866575</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+
+</div>
+<pre id="test">
+<script>
+/** Test for Bug 866575 **/
+
+var canvas1 = document.createElementNS('http://www.w3.org/1999/xhtml', 'canvas');
+canvas1.width = "306368";
+var canvas2 = document.createElementNS('http://www.w3.org/1999/xhtml', 'canvas');
+try {
+  canvas2.getContext('2d').createPattern(canvas1, 'repeat-x');
+} catch (e) {}
+finally {
+  ok(true, "Didn't crash");
+}
+
+</script>
+</pre>
+</body>
+</html>
--- a/layout/base/nsLayoutUtils.cpp
+++ b/layout/base/nsLayoutUtils.cpp
@@ -4649,16 +4649,19 @@ nsLayoutUtils::SurfaceFromElement(HTMLCa
 
   if (!surf) {
     if (wantImageSurface) {
       surf = new gfxImageSurface(size, gfxASurface::ImageFormatARGB32);
     } else {
       surf = gfxPlatform::GetPlatform()->CreateOffscreenSurface(size, gfxASurface::CONTENT_COLOR_ALPHA);
     }
 
+    if (!surf)
+      return result;
+
     nsRefPtr<gfxContext> ctx = new gfxContext(surf);
     // XXX shouldn't use the external interface, but maybe we can layerify this
     uint32_t flags = premultAlpha ? HTMLCanvasElement::RenderFlagPremultAlpha : 0;
     rv = aElement->RenderContextsExternal(ctx, gfxPattern::FILTER_NEAREST, flags);
     if (NS_FAILED(rv))
       return result;
   }