Bug 1334647 - Make canvas.drawImage trigger a JS error rather than a critical error on an invalid target. r=rhunt, a=jcristau
authorLee Salzman <lsalzman@mozilla.com>
Tue, 31 Jan 2017 11:17:50 -0500
changeset 375770 7d746d214c73fe9b43cd9c7f02466d0db802a3d6
parent 375769 e5f851a668419416d2328143ecb08783d21697f8
child 375771 0d5fd88afc55a306466f7d98f895ea9181cc5526
push id6996
push userjlorenzo@mozilla.com
push dateMon, 06 Mar 2017 20:48:21 +0000
treeherdermozilla-beta@d89512dab048 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersrhunt, jcristau
bugs1334647
milestone53.0a2
Bug 1334647 - Make canvas.drawImage trigger a JS error rather than a critical error on an invalid target. r=rhunt, a=jcristau MozReview-Commit-ID: 3TxJM0tjhVC
dom/canvas/CanvasRenderingContext2D.cpp
dom/canvas/crashtests/1334647-1.html
dom/canvas/crashtests/crashtests.list
--- a/dom/canvas/CanvasRenderingContext2D.cpp
+++ b/dom/canvas/CanvasRenderingContext2D.cpp
@@ -5001,17 +5001,17 @@ CanvasRenderingContext2D::DrawImage(cons
   gfx::Rect bounds;
 
   if (NeedToCalculateBounds()) {
     bounds = gfx::Rect(aDx, aDy, aDw, aDh);
     bounds = mTarget->GetTransform().TransformBounds(bounds);
   }
 
   if (!IsTargetValid()) {
-    gfxCriticalError() << "Unexpected invalid target in a Canvas2d.";
+    aError.Throw(NS_ERROR_FAILURE);
     return;
   }
 
   if (srcSurf) {
     gfx::Rect sourceRect(aSx, aSy, aSw, aSh);
     if (element == mCanvasElement) {
       // srcSurf is a snapshot of mTarget. If we draw to mTarget now, we'll
       // trigger a COW copy of the whole canvas into srcSurf. That's a huge
new file mode 100644
--- /dev/null
+++ b/dom/canvas/crashtests/1334647-1.html
@@ -0,0 +1,8 @@
+<script>
+Logger={}; Logger.JSError=function(e){};
+try { o0 = document.createElement('canvas'); } catch(e) { Logger.JSError(e); }
+try { (document.body || document.documentElement).appendChild(o0) } catch(e) { Logger.JSError(e); }
+try { o1 = o0.getContext('2d'); } catch(e) { Logger.JSError(e); }
+try { o0.width = 311853383.455201; } catch(e) { Logger.JSError(e); }
+try { o1.drawImage(o0, -0.906275445340731, 0.3679144809413502, 2, 32) } catch(e) { Logger.JSError(e); }
+</script>
--- a/dom/canvas/crashtests/crashtests.list
+++ b/dom/canvas/crashtests/crashtests.list
@@ -34,9 +34,9 @@ skip-if(d2d) load 1287515-1.html
 asserts-if(stylo,1) load 1287652-1.html # bug 1324700
 asserts-if(stylo,1) load 1288872-1.html # bug 1324700
 load 1290628-1.html
 asserts-if(stylo,1) load 1283113-1.html # bug 1324700
 load 1286458-1.html
 load 1299062-1.html
 load 1305312-1.html
 load 1298576-1.html
-
+load 1334647-1.html