⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 243820 in webkit


Ignore:
Timestamp:
Apr 3, 2019, 1:04:37 PM (7 years ago)
Author:
rniwa@webkit.org
Message:

Crash in HTMLCanvasElement::createContext2d after the element got adopted to a new document
​https://bugs.webkit.org/show_bug.cgi?id=196527

Reviewed by Antti Koivisto.

We need to update CanvasBase::m_scriptExecutionContext when HTMLCanvasElement moves from
one document to another. Fixed the bug by making CanvasBase::scriptExecutionContext make
a virtual function call instead of directly storing a raw pointer. In HTMLCanvasElement,
we use Node::scriptExecutionContext(). Use ContextDestructionObserver in CustomPaintCanvas
and OffscreenCanvas instead of a raw pointer.

Unfortunately, no new tests since there is no reproducible test case.

  • html/CanvasBase.cpp:

(WebCore::CanvasBase::CanvasBase):

  • html/CanvasBase.h:

(WebCore::CanvasBase::scriptExecutionContext const):

  • html/CustomPaintCanvas.cpp:

(WebCore::CustomPaintCanvas::CustomPaintCanvas):

  • html/CustomPaintCanvas.h:
  • html/HTMLCanvasElement.cpp:

(WebCore::HTMLCanvasElement::HTMLCanvasElement):

  • html/HTMLCanvasElement.h:
  • html/OffscreenCanvas.cpp:

(WebCore::OffscreenCanvas::OffscreenCanvas):

  • html/OffscreenCanvas.h:
Location:
trunk/Source/WebCore
Files:
9 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/WebCore/ChangeLog

    r243819 r243820  
     12019-04-02  Ryosuke Niwa  <rniwa@webkit.org>
     2
     3        Crash in HTMLCanvasElement::createContext2d after the element got adopted to a new document
     4        https://bugs.webkit.org/show_bug.cgi?id=196527
     5
     6        Reviewed by Antti Koivisto.
     7
     8        We need to update CanvasBase::m_scriptExecutionContext when HTMLCanvasElement moves from
     9        one document to another. Fixed the bug by making CanvasBase::scriptExecutionContext make
     10        a virtual function call instead of directly storing a raw pointer. In HTMLCanvasElement,
     11        we use Node::scriptExecutionContext(). Use ContextDestructionObserver in CustomPaintCanvas
     12        and OffscreenCanvas instead of a raw pointer.
     13
     14        Unfortunately, no new tests since there is no reproducible test case.
     15
     16        * html/CanvasBase.cpp:
     17        (WebCore::CanvasBase::CanvasBase):
     18        * html/CanvasBase.h:
     19        (WebCore::CanvasBase::scriptExecutionContext const):
     20        * html/CustomPaintCanvas.cpp:
     21        (WebCore::CustomPaintCanvas::CustomPaintCanvas):
     22        * html/CustomPaintCanvas.h:
     23        * html/HTMLCanvasElement.cpp:
     24        (WebCore::HTMLCanvasElement::HTMLCanvasElement):
     25        * html/HTMLCanvasElement.h:
     26        * html/OffscreenCanvas.cpp:
     27        (WebCore::OffscreenCanvas::OffscreenCanvas):
     28        * html/OffscreenCanvas.h:
     29
    1302019-04-03  Myles C. Maxfield  <mmaxfield@apple.com>
    231

  • trunk/Source/WebCore/html/CanvasBase.cpp

    r243611 r243820  
    3636namespace WebCore {
    3737
    38 CanvasBase::CanvasBase(ScriptExecutionContext* scriptExecutionContext)
    39     : m_scriptExecutionContext(scriptExecutionContext)
     38CanvasBase::CanvasBase()
    4039{
    4140}

  • trunk/Source/WebCore/html/CanvasBase.h

    r237777 r243820  
    7575
    7676    virtual SecurityOrigin* securityOrigin() const { return nullptr; }
    77     ScriptExecutionContext* scriptExecutionContext() const { return m_scriptExecutionContext; }
     77    ScriptExecutionContext* scriptExecutionContext() const { return canvasBaseScriptExecutionContext(); }
    7878
    7979    CanvasRenderingContext* renderingContext() const;
    … …  
    9999
    100100protected:
    101     CanvasBase(ScriptExecutionContext*);
     101    CanvasBase();
     102
     103    virtual ScriptExecutionContext* canvasBaseScriptExecutionContext() const = 0;
    102104
    103105    std::unique_ptr<CanvasRenderingContext> m_context;
    … …  
    108110    bool m_didNotifyObserversCanvasDestroyed { false };
    109111#endif
    110     ScriptExecutionContext* m_scriptExecutionContext;
    111112    HashSet<CanvasObserver*> m_observers;
    112113};

  • trunk/Source/WebCore/html/CustomPaintCanvas.cpp

    r238839 r243820  
    4040
    4141CustomPaintCanvas::CustomPaintCanvas(ScriptExecutionContext& context, unsigned width, unsigned height)
    42     : CanvasBase(&context)
     42    : ContextDestructionObserver(&context)
    4343    , m_size(width, height)
    4444{

  • trunk/Source/WebCore/html/CustomPaintCanvas.h

    r238839 r243820  
    4545class PaintRenderingContext2D;
    4646
    47 class CustomPaintCanvas final : public RefCounted<CustomPaintCanvas>, public CanvasBase {
     47class CustomPaintCanvas final : public RefCounted<CustomPaintCanvas>, public CanvasBase, private ContextDestructionObserver {
    4848    WTF_MAKE_FAST_ALLOCATED;
    4949public:
    … …  
    8181    void refCanvasBase() final { ref(); }
    8282    void derefCanvasBase() final { deref(); }
     83    ScriptExecutionContext* canvasBaseScriptExecutionContext() const final { return ContextDestructionObserver::scriptExecutionContext(); }
    8384
    8485    mutable GraphicsContext* m_destinationGraphicsContext = nullptr;

  • trunk/Source/WebCore/html/HTMLCanvasElement.cpp

    r243666 r243820  
    117117HTMLCanvasElement::HTMLCanvasElement(const QualifiedName& tagName, Document& document)
    118118    : HTMLElement(tagName, document)
    119     , CanvasBase(&document)
    120119    , m_size(defaultWidth, defaultHeight)
    121120{

  • trunk/Source/WebCore/html/HTMLCanvasElement.h

    r243666 r243820  
    180180    void derefCanvasBase() final { HTMLElement::deref(); }
    181181
     182    ScriptExecutionContext* canvasBaseScriptExecutionContext() const final { return HTMLElement::scriptExecutionContext(); }
     183
    182184    FloatRect m_dirtyRect;
    183185    mutable IntSize m_size;

  • trunk/Source/WebCore/html/OffscreenCanvas.cpp

    r243163 r243820  
    3939
    4040OffscreenCanvas::OffscreenCanvas(ScriptExecutionContext& context, unsigned width, unsigned height)
    41     : CanvasBase(&context)
     41    : ContextDestructionObserver(&context)
    4242    , m_size(width, height)
    4343{

  • trunk/Source/WebCore/html/OffscreenCanvas.h

    r237344 r243820  
    4646#endif
    4747
    48 class OffscreenCanvas final : public RefCounted<OffscreenCanvas>, public CanvasBase, public EventTargetWithInlineData {
     48class OffscreenCanvas final : public RefCounted<OffscreenCanvas>, public CanvasBase, public EventTargetWithInlineData, private ContextDestructionObserver {
    4949    WTF_MAKE_FAST_ALLOCATED;
    5050public:
    … …  
    9595    bool isOffscreenCanvas() const final { return true; }
    9696
    97     ScriptExecutionContext* scriptExecutionContext() const final { return CanvasBase::scriptExecutionContext(); }
     97    ScriptExecutionContext* scriptExecutionContext() const final { return ContextDestructionObserver::scriptExecutionContext(); }
     98    ScriptExecutionContext* canvasBaseScriptExecutionContext() const final { return ContextDestructionObserver::scriptExecutionContext(); }
    9899
    99100    EventTargetInterface eventTargetInterface() const final { return OffscreenCanvasEventTargetInterfaceType; }
Note: See TracChangeset for help on using the changeset viewer.