⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 244017 in webkit


Ignore:
Timestamp:
Apr 8, 2019, 5:39:58 AM (7 years ago)
Author:
Carlos Garcia Campos
Message:

Merge r243820 - Crash in HTMLCanvasElement::createContext2d after the element got adopted to a new document
​https://bugs.webkit.org/show_bug.cgi?id=196527

Reviewed by Antti Koivisto.

We need to update CanvasBase::m_scriptExecutionContext when HTMLCanvasElement moves from
one document to another. Fixed the bug by making CanvasBase::scriptExecutionContext make
a virtual function call instead of directly storing a raw pointer. In HTMLCanvasElement,
we use Node::scriptExecutionContext(). Use ContextDestructionObserver in CustomPaintCanvas
and OffscreenCanvas instead of a raw pointer.

Unfortunately, no new tests since there is no reproducible test case.

  • html/CanvasBase.cpp:

(WebCore::CanvasBase::CanvasBase):

  • html/CanvasBase.h:

(WebCore::CanvasBase::scriptExecutionContext const):

  • html/CustomPaintCanvas.cpp:

(WebCore::CustomPaintCanvas::CustomPaintCanvas):

  • html/CustomPaintCanvas.h:
  • html/HTMLCanvasElement.cpp:

(WebCore::HTMLCanvasElement::HTMLCanvasElement):

  • html/HTMLCanvasElement.h:
  • html/OffscreenCanvas.cpp:

(WebCore::OffscreenCanvas::OffscreenCanvas):

  • html/OffscreenCanvas.h:
Location:
releases/WebKitGTK/webkit-2.24/Source/WebCore
Files:
9 edited

Legend:

Unmodified
Added
Removed

  • releases/WebKitGTK/webkit-2.24/Source/WebCore/ChangeLog

    r244015 r244017  
     12019-04-02  Ryosuke Niwa  <rniwa@webkit.org>
     2
     3        Crash in HTMLCanvasElement::createContext2d after the element got adopted to a new document
     4        https://bugs.webkit.org/show_bug.cgi?id=196527
     5
     6        Reviewed by Antti Koivisto.
     7
     8        We need to update CanvasBase::m_scriptExecutionContext when HTMLCanvasElement moves from
     9        one document to another. Fixed the bug by making CanvasBase::scriptExecutionContext make
     10        a virtual function call instead of directly storing a raw pointer. In HTMLCanvasElement,
     11        we use Node::scriptExecutionContext(). Use ContextDestructionObserver in CustomPaintCanvas
     12        and OffscreenCanvas instead of a raw pointer.
     13
     14        Unfortunately, no new tests since there is no reproducible test case.
     15
     16        * html/CanvasBase.cpp:
     17        (WebCore::CanvasBase::CanvasBase):
     18        * html/CanvasBase.h:
     19        (WebCore::CanvasBase::scriptExecutionContext const):
     20        * html/CustomPaintCanvas.cpp:
     21        (WebCore::CustomPaintCanvas::CustomPaintCanvas):
     22        * html/CustomPaintCanvas.h:
     23        * html/HTMLCanvasElement.cpp:
     24        (WebCore::HTMLCanvasElement::HTMLCanvasElement):
     25        * html/HTMLCanvasElement.h:
     26        * html/OffscreenCanvas.cpp:
     27        (WebCore::OffscreenCanvas::OffscreenCanvas):
     28        * html/OffscreenCanvas.h:
     29
    1302019-03-26  Dean Jackson  <dino@apple.com>
    231

  • releases/WebKitGTK/webkit-2.24/Source/WebCore/html/CanvasBase.cpp

    r237777 r244017  
    3535namespace WebCore {
    3636
    37 CanvasBase::CanvasBase(ScriptExecutionContext* scriptExecutionContext)
    38     : m_scriptExecutionContext(scriptExecutionContext)
     37CanvasBase::CanvasBase()
    3938{
    4039}

  • releases/WebKitGTK/webkit-2.24/Source/WebCore/html/CanvasBase.h

    r237777 r244017  
    7575
    7676    virtual SecurityOrigin* securityOrigin() const { return nullptr; }
    77     ScriptExecutionContext* scriptExecutionContext() const { return m_scriptExecutionContext; }
     77    ScriptExecutionContext* scriptExecutionContext() const { return canvasBaseScriptExecutionContext(); }
    7878
    7979    CanvasRenderingContext* renderingContext() const;
    … …  
    9999
    100100protected:
    101     CanvasBase(ScriptExecutionContext*);
     101    CanvasBase();
     102
     103    virtual ScriptExecutionContext* canvasBaseScriptExecutionContext() const = 0;
    102104
    103105    std::unique_ptr<CanvasRenderingContext> m_context;
    … …  
    108110    bool m_didNotifyObserversCanvasDestroyed { false };
    109111#endif
    110     ScriptExecutionContext* m_scriptExecutionContext;
    111112    HashSet<CanvasObserver*> m_observers;
    112113};

  • releases/WebKitGTK/webkit-2.24/Source/WebCore/html/CustomPaintCanvas.cpp

    r238839 r244017  
    4040
    4141CustomPaintCanvas::CustomPaintCanvas(ScriptExecutionContext& context, unsigned width, unsigned height)
    42     : CanvasBase(&context)
     42    : ContextDestructionObserver(&context)
    4343    , m_size(width, height)
    4444{

  • releases/WebKitGTK/webkit-2.24/Source/WebCore/html/CustomPaintCanvas.h

    r238839 r244017  
    4545class PaintRenderingContext2D;
    4646
    47 class CustomPaintCanvas final : public RefCounted<CustomPaintCanvas>, public CanvasBase {
     47class CustomPaintCanvas final : public RefCounted<CustomPaintCanvas>, public CanvasBase, private ContextDestructionObserver {
    4848    WTF_MAKE_FAST_ALLOCATED;
    4949public:
    … …  
    8181    void refCanvasBase() final { ref(); }
    8282    void derefCanvasBase() final { deref(); }
     83    ScriptExecutionContext* canvasBaseScriptExecutionContext() const final { return ContextDestructionObserver::scriptExecutionContext(); }
    8384
    8485    mutable GraphicsContext* m_destinationGraphicsContext = nullptr;

  • releases/WebKitGTK/webkit-2.24/Source/WebCore/html/HTMLCanvasElement.cpp

    r241420 r244017  
    121121HTMLCanvasElement::HTMLCanvasElement(const QualifiedName& tagName, Document& document)
    122122    : HTMLElement(tagName, document)
    123     , CanvasBase(&document)
    124123    , m_size(defaultWidth, defaultHeight)
    125124{

  • releases/WebKitGTK/webkit-2.24/Source/WebCore/html/HTMLCanvasElement.h

    r239427 r244017  
    186186    void derefCanvasBase() final { HTMLElement::deref(); }
    187187
     188    ScriptExecutionContext* canvasBaseScriptExecutionContext() const final { return HTMLElement::scriptExecutionContext(); }
     189
    188190    FloatRect m_dirtyRect;
    189191    mutable IntSize m_size;

  • releases/WebKitGTK/webkit-2.24/Source/WebCore/html/OffscreenCanvas.cpp

    r237409 r244017  
    3939
    4040OffscreenCanvas::OffscreenCanvas(ScriptExecutionContext& context, unsigned width, unsigned height)
    41     : CanvasBase(&context)
     41    : ContextDestructionObserver(&context)
    4242    , m_size(width, height)
    4343{

  • releases/WebKitGTK/webkit-2.24/Source/WebCore/html/OffscreenCanvas.h

    r237344 r244017  
    4646#endif
    4747
    48 class OffscreenCanvas final : public RefCounted<OffscreenCanvas>, public CanvasBase, public EventTargetWithInlineData {
     48class OffscreenCanvas final : public RefCounted<OffscreenCanvas>, public CanvasBase, public EventTargetWithInlineData, private ContextDestructionObserver {
    4949    WTF_MAKE_FAST_ALLOCATED;
    5050public:
    … …  
    9595    bool isOffscreenCanvas() const final { return true; }
    9696
    97     ScriptExecutionContext* scriptExecutionContext() const final { return CanvasBase::scriptExecutionContext(); }
     97    ScriptExecutionContext* scriptExecutionContext() const final { return ContextDestructionObserver::scriptExecutionContext(); }
     98    ScriptExecutionContext* canvasBaseScriptExecutionContext() const final { return ContextDestructionObserver::scriptExecutionContext(); }
    9899
    99100    EventTargetInterface eventTargetInterface() const final { return OffscreenCanvasEventTargetInterfaceType; }
Note: See TracChangeset for help on using the changeset viewer.