⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 185766 in webkit


Ignore:
Timestamp:
Jun 19, 2015, 1:45:54 PM (11 years ago)
Author:
Brent Fulgham
Message:

All calls of ImageBuffer::create should null check the return value
​https://bugs.webkit.org/show_bug.cgi?id=22132

Reviewed by Zalan Bujtas.

ImageBuffer::create returns nullptr for a number of reasons, and should be
expected to do so. We missed this check in a few places, resulting in
crashes on some systems. Likewise, ImageBuffer::copyImage may return nullptr
in normal use and should be checked.

Source/WebCore:

  • platform/graphics/BitmapImage.cpp:

(WebCore::BitmapImage::drawPattern): Add nullptr check for create and copyImage. Remove
extra call to 'setImageObserver'.

  • platform/graphics/cairo/ImageBufferCairo.cpp:

(WebCore::ImageBuffer::drawPattern): Add nullptr check for copyImage.

  • platform/graphics/cg/ImageBufferCG.cpp:

(WebCore::ImageBuffer::drawPattern): Add nullptr checks for copyImage.

  • platform/graphics/filters/FETile.cpp:

(WebCore::FETile::platformApplySoftware): Add nullptr check for copyImage.

  • platform/graphics/filters/FilterEffect.cpp:

(WebCore::FilterEffect::asImageBuffer): Add nullptr check for create.
(WebCore::FilterEffect::openCLImageToImageBuffer): Ditto.

  • platform/graphics/texmap/BitmapTexture.cpp:

(WebCore::BitmapTexture::updateContents): Add nullptr checks for create and copyImage.

  • svg/graphics/SVGImage.cpp:

(WebCore::SVGImage::drawPatternForContainer): Add nullptr check for copyImage.

Source/WebKit/mac:

  • WebCoreSupport/WebContextMenuClient.mm:

(WebContextMenuClient::imageForCurrentSharingServicePickerItem): Add nullptr check
for copyImage.

Location:
trunk/Source
Files:
10 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/WebCore/ChangeLog

    r185763 r185766  
     12015-06-19  Brent Fulgham  <bfulgham@apple.com>
     2
     3        All calls of ImageBuffer::create should null check the return value
     4        https://bugs.webkit.org/show_bug.cgi?id=22132
     5
     6        Reviewed by Zalan Bujtas.
     7
     8        ImageBuffer::create returns nullptr for a number of reasons, and should be
     9        expected to do so. We missed this check in a few places, resulting in
     10        crashes on some systems. Likewise, ImageBuffer::copyImage may return nullptr
     11        in normal use and should be checked.
     12
     13        * platform/graphics/BitmapImage.cpp:
     14        (WebCore::BitmapImage::drawPattern): Add nullptr check for create and copyImage. Remove
     15        extra call to 'setImageObserver'.
     16        * platform/graphics/cairo/ImageBufferCairo.cpp:
     17        (WebCore::ImageBuffer::drawPattern): Add nullptr check for copyImage.
     18        * platform/graphics/cg/ImageBufferCG.cpp:
     19        (WebCore::ImageBuffer::drawPattern): Add nullptr checks for copyImage.
     20        * platform/graphics/filters/FETile.cpp:
     21        (WebCore::FETile::platformApplySoftware): Add nullptr check for copyImage.
     22        * platform/graphics/filters/FilterEffect.cpp:
     23        (WebCore::FilterEffect::asImageBuffer): Add nullptr check for create.
     24        (WebCore::FilterEffect::openCLImageToImageBuffer): Ditto.
     25        * platform/graphics/texmap/BitmapTexture.cpp:
     26        (WebCore::BitmapTexture::updateContents): Add nullptr checks for create and copyImage.
     27        * svg/graphics/SVGImage.cpp:
     28        (WebCore::SVGImage::drawPatternForContainer): Add nullptr check for copyImage.
     29
    1302015-06-19  Jeremy Jones  <jeremyj@apple.com>
    231

  • trunk/Source/WebCore/platform/graphics/BitmapImage.cpp

    r184793 r185766  
    11/*
    22 * Copyright (C) 2006 Samuel Weinig (sam.weinig@gmail.com)
    3  * Copyright (C) 2004, 2005, 2006, 2008 Apple Inc. All rights reserved.
     3 * Copyright (C) 2004, 2005, 2006, 2008, 2015 Apple Inc. All rights reserved.
    44 *
    55 * Redistribution and use in source and binary forms, with or without
    … …  
    618618    if (!m_cachedImage) {
    619619        std::unique_ptr<ImageBuffer> buffer = ImageBuffer::create(expandedIntSize(tileRect.size()));
    620         ASSERT(buffer.get());
     620        if (!buffer)
     621            return;
    621622
    622623        ImageObserver* observer = imageObserver();
    … …  
    624625
    625626        // Temporarily reset image observer, we don't want to receive any changeInRect() calls due to this relayout.
    626         setImageObserver(0);
     627        setImageObserver(nullptr);
    627628
    628629        draw(buffer->context(), tileRect, tileRect, styleColorSpace, op, blendMode, ImageOrientationDescription());
    … …  
    632633
    633634        m_cachedImage = buffer->copyImage(DontCopyBackingStore, Unscaled);
     635        if (!m_cachedImage)
     636            return;
     637
    634638        m_cachedImage->setSpaceSize(spaceSize());
    635 
    636         setImageObserver(observer);
    637639    }
    638640

  • trunk/Source/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp

    r185417 r185766  
    162162    const FloatPoint& phase, ColorSpace styleColorSpace, CompositeOperator op, const FloatRect& destRect, BlendMode)
    163163{
    164     RefPtr<Image> image = copyImage(DontCopyBackingStore);
    165     image->drawPattern(context, srcRect, patternTransform, phase, styleColorSpace, op, destRect);
     164    if (RefPtr<Image> image = copyImage(DontCopyBackingStore))
     165        image->drawPattern(context, srcRect, patternTransform, phase, styleColorSpace, op, destRect);
    166166}
    167167

  • trunk/Source/WebCore/platform/graphics/cg/ImageBufferCG.cpp

    r183234 r185766  
    11/*
    22 * Copyright (C) 2006 Nikolas Zimmermann <zimmermann@kde.org>
    3  * Copyright (C) 2008 Apple Inc. All rights reserved.
     3 * Copyright (C) 2008, 2015 Apple Inc. All rights reserved.
    44 * Copyright (C) 2010 Torch Mobile (Beijing) Co. Ltd. All rights reserved.
    55 *
    … …  
    255255    if (!context()->isAcceleratedContext()) {
    256256        if (destContext == context() || destContext->isAcceleratedContext()) {
    257             RefPtr<Image> copy = copyImage(CopyBackingStore); // Drawing into our own buffer, need to deep copy.
    258             copy->drawPattern(destContext, adjustedSrcRect, patternTransform, phase, styleColorSpace, op, destRect, blendMode);
     257            if (RefPtr<Image> copy = copyImage(CopyBackingStore)) // Drawing into our own buffer, need to deep copy.
     258                copy->drawPattern(destContext, adjustedSrcRect, patternTransform, phase, styleColorSpace, op, destRect, blendMode);
    259259        } else {
    260             RefPtr<Image> imageForRendering = copyImage(DontCopyBackingStore);
    261             imageForRendering->drawPattern(destContext, adjustedSrcRect, patternTransform, phase, styleColorSpace, op, destRect, blendMode);
     260            if (RefPtr<Image> imageForRendering = copyImage(DontCopyBackingStore))
     261                imageForRendering->drawPattern(destContext, adjustedSrcRect, patternTransform, phase, styleColorSpace, op, destRect, blendMode);
    262262        }
    263263    } else {
    264         RefPtr<Image> copy = copyImage(CopyBackingStore);
    265         copy->drawPattern(destContext, adjustedSrcRect, patternTransform, phase, styleColorSpace, op, destRect, blendMode);
     264        if (RefPtr<Image> copy = copyImage(CopyBackingStore))
     265            copy->drawPattern(destContext, adjustedSrcRect, patternTransform, phase, styleColorSpace, op, destRect, blendMode);
    266266    }
    267267}

  • trunk/Source/WebCore/platform/graphics/filters/FETile.cpp

    r183956 r185766  
    7272    tileImageContext->drawImageBuffer(in->asImageBuffer(), ColorSpaceDeviceRGB, in->absolutePaintRect().location());
    7373
    74     auto pattern = Pattern::create(tileImage->copyImage(CopyBackingStore), true, true);
     74    auto tileImageCopy = tileImage->copyImage(CopyBackingStore);
     75    if (!tileImageCopy)
     76        return;
     77
     78    auto pattern = Pattern::create(tileImageCopy, true, true);
    7579
    7680    AffineTransform patternTransform;

  • trunk/Source/WebCore/platform/graphics/filters/FilterEffect.cpp

    r185392 r185766  
    44 * Copyright (C) Research In Motion Limited 2010. All rights reserved.
    55 * Copyright (C) 2012 University of Szeged
     6 * Copyright (C) 2015 Apple Inc. All rights reserved.
    67 *
    78 * This library is free software; you can redistribute it and/or
    … …  
    269270{
    270271    if (!hasResult())
    271         return 0;
     272        return nullptr;
    272273    if (m_imageBufferResult)
    273274        return m_imageBufferResult.get();
    … …  
    277278#endif
    278279    m_imageBufferResult = ImageBuffer::create(m_absolutePaintRect.size(), m_filter.filterScale(), m_resultColorSpace, m_filter.renderingMode());
     280    if (!m_imageBufferResult)
     281        return nullptr;
     282
    279283    IntRect destinationRect(IntPoint(), m_absolutePaintRect.size());
    280284    if (m_premultipliedImageResult)
    … …  
    292296
    293297    if (context->inError())
    294         return 0;
     298        return nullptr;
    295299
    296300    size_t origin[3] = { 0, 0, 0 };
    … …  
    300304
    301305    if (context->isFailed(clFinish(context->commandQueue())))
    302         return 0;
     306        return nullptr;
    303307
    304308    if (context->isFailed(clEnqueueReadImage(context->commandQueue(), m_openCLImageResult, CL_TRUE, origin, region, 0, 0, destinationPixelArray->data(), 0, 0, 0)))
    305         return 0;
     309        return nullptr;
    306310
    307311    m_imageBufferResult = ImageBuffer::create(m_absolutePaintRect.size());
     312    if (!m_imageBufferResult)
     313        return nullptr;
     314
    308315    IntRect destinationRect(IntPoint(), m_absolutePaintRect.size());
    309316    m_imageBufferResult->putByteArray(Unmultiplied, destinationPixelArray.get(), destinationRect.size(), destinationRect, IntPoint());

  • trunk/Source/WebCore/platform/graphics/texmap/BitmapTexture.cpp

    r185752 r185766  
    5151
    5252    RefPtr<Image> image = imageBuffer->copyImage(DontCopyBackingStore);
     53    if (!image)
     54        return;
    5355
    5456    updateContents(image.get(), targetRect, IntPoint(), updateContentsFlag);

  • trunk/Source/WebCore/svg/graphics/SVGImage.cpp

    r185395 r185766  
    11/*
    22 * Copyright (C) 2006 Eric Seidel <eric@webkit.org>
    3  * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
     3 * Copyright (C) 2008, 2009, 2015 Apple Inc. All rights reserved.
    44 * Copyright (C) Research In Motion Limited 2011. All rights reserved.
    55 *
    … …  
    208208
    209209    RefPtr<Image> image = buffer->copyImage(DontCopyBackingStore, Unscaled);
     210    if (!image)
     211        return;
    210212    image->setSpaceSize(spaceSize());
    211213

  • trunk/Source/WebKit/mac/ChangeLog

    r185727 r185766  
     12015-06-19  Brent Fulgham  <bfulgham@apple.com>
     2
     3        All calls of ImageBuffer::create should null check the return value
     4        https://bugs.webkit.org/show_bug.cgi?id=22132
     5
     6        Reviewed by Zalan Bujtas.
     7
     8        ImageBuffer::create returns nullptr for a number of reasons, and should be
     9        expected to do so. We missed this check in a few places, resulting in
     10        crashes on some systems. Likewise, ImageBuffer::copyImage may return nullptr
     11        in normal use and should be checked.
     12
     13        * WebCoreSupport/WebContextMenuClient.mm:
     14        (WebContextMenuClient::imageForCurrentSharingServicePickerItem): Add nullptr check
     15        for copyImage.
     16
    1172015-06-18  Jon Lee  <jonlee@apple.com>
    218

  • trunk/Source/WebKit/mac/WebCoreSupport/WebContextMenuClient.mm

    r183158 r185766  
    484484
    485485    RefPtr<Image> image = buffer->copyImage(DontCopyBackingStore);
     486    if (!image)
     487        return nil;
     488
    486489    return image->getNSImage();
    487490}
Note: See TracChangeset for help on using the changeset viewer.