⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 245347 in webkit


Ignore:
Timestamp:
May 15, 2019, 2:44:39 PM (7 years ago)
Author:
Alan Coon
Message:

Cherry-pick r243820. rdar://problem/50753921

Crash in HTMLCanvasElement::createContext2d after the element got adopted to a new document
​https://bugs.webkit.org/show_bug.cgi?id=196527

Reviewed by Antti Koivisto.

We need to update CanvasBase::m_scriptExecutionContext when HTMLCanvasElement moves from
one document to another. Fixed the bug by making CanvasBase::scriptExecutionContext make
a virtual function call instead of directly storing a raw pointer. In HTMLCanvasElement,
we use Node::scriptExecutionContext(). Use ContextDestructionObserver in CustomPaintCanvas
and OffscreenCanvas instead of a raw pointer.

Unfortunately, no new tests since there is no reproducible test case.

  • html/CanvasBase.cpp: (WebCore::CanvasBase::CanvasBase):
  • html/CanvasBase.h: (WebCore::CanvasBase::scriptExecutionContext const):
  • html/CustomPaintCanvas.cpp: (WebCore::CustomPaintCanvas::CustomPaintCanvas):
  • html/CustomPaintCanvas.h:
  • html/HTMLCanvasElement.cpp: (WebCore::HTMLCanvasElement::HTMLCanvasElement):
  • html/HTMLCanvasElement.h:
  • html/OffscreenCanvas.cpp: (WebCore::OffscreenCanvas::OffscreenCanvas):
  • html/OffscreenCanvas.h:

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@243820 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:
branches/safari-607-branch/Source/WebCore
Files:
9 edited

Legend:

Unmodified
Added
Removed

  • branches/safari-607-branch/Source/WebCore/ChangeLog

    r245346 r245347  
     12019-05-14  Kocsen Chung  <kocsen_chung@apple.com>
     2
     3        Cherry-pick r243820. rdar://problem/50753921
     4
     5    Crash in HTMLCanvasElement::createContext2d after the element got adopted to a new document
     6    https://bugs.webkit.org/show_bug.cgi?id=196527
     7   
     8    Reviewed by Antti Koivisto.
     9   
     10    We need to update CanvasBase::m_scriptExecutionContext when HTMLCanvasElement moves from
     11    one document to another. Fixed the bug by making CanvasBase::scriptExecutionContext make
     12    a virtual function call instead of directly storing a raw pointer. In HTMLCanvasElement,
     13    we use Node::scriptExecutionContext(). Use ContextDestructionObserver in CustomPaintCanvas
     14    and OffscreenCanvas instead of a raw pointer.
     15   
     16    Unfortunately, no new tests since there is no reproducible test case.
     17   
     18    * html/CanvasBase.cpp:
     19    (WebCore::CanvasBase::CanvasBase):
     20    * html/CanvasBase.h:
     21    (WebCore::CanvasBase::scriptExecutionContext const):
     22    * html/CustomPaintCanvas.cpp:
     23    (WebCore::CustomPaintCanvas::CustomPaintCanvas):
     24    * html/CustomPaintCanvas.h:
     25    * html/HTMLCanvasElement.cpp:
     26    (WebCore::HTMLCanvasElement::HTMLCanvasElement):
     27    * html/HTMLCanvasElement.h:
     28    * html/OffscreenCanvas.cpp:
     29    (WebCore::OffscreenCanvas::OffscreenCanvas):
     30    * html/OffscreenCanvas.h:
     31   
     32   
     33    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243820 268f45cc-cd09-0410-ab3c-d52691b4dbfc
     34
     35    2019-04-02  Ryosuke Niwa  <rniwa@webkit.org>
     36
     37            Crash in HTMLCanvasElement::createContext2d after the element got adopted to a new document
     38            https://bugs.webkit.org/show_bug.cgi?id=196527
     39
     40            Reviewed by Antti Koivisto.
     41
     42            We need to update CanvasBase::m_scriptExecutionContext when HTMLCanvasElement moves from
     43            one document to another. Fixed the bug by making CanvasBase::scriptExecutionContext make
     44            a virtual function call instead of directly storing a raw pointer. In HTMLCanvasElement,
     45            we use Node::scriptExecutionContext(). Use ContextDestructionObserver in CustomPaintCanvas
     46            and OffscreenCanvas instead of a raw pointer.
     47
     48            Unfortunately, no new tests since there is no reproducible test case.
     49
     50            * html/CanvasBase.cpp:
     51            (WebCore::CanvasBase::CanvasBase):
     52            * html/CanvasBase.h:
     53            (WebCore::CanvasBase::scriptExecutionContext const):
     54            * html/CustomPaintCanvas.cpp:
     55            (WebCore::CustomPaintCanvas::CustomPaintCanvas):
     56            * html/CustomPaintCanvas.h:
     57            * html/HTMLCanvasElement.cpp:
     58            (WebCore::HTMLCanvasElement::HTMLCanvasElement):
     59            * html/HTMLCanvasElement.h:
     60            * html/OffscreenCanvas.cpp:
     61            (WebCore::OffscreenCanvas::OffscreenCanvas):
     62            * html/OffscreenCanvas.h:
     63
    1642019-05-14  Kocsen Chung  <kocsen_chung@apple.com>
    265

  • branches/safari-607-branch/Source/WebCore/html/CanvasBase.cpp

    r237777 r245347  
    3535namespace WebCore {
    3636
    37 CanvasBase::CanvasBase(ScriptExecutionContext* scriptExecutionContext)
    38     : m_scriptExecutionContext(scriptExecutionContext)
     37CanvasBase::CanvasBase()
    3938{
    4039}

  • branches/safari-607-branch/Source/WebCore/html/CanvasBase.h

    r237777 r245347  
    7575
    7676    virtual SecurityOrigin* securityOrigin() const { return nullptr; }
    77     ScriptExecutionContext* scriptExecutionContext() const { return m_scriptExecutionContext; }
     77    ScriptExecutionContext* scriptExecutionContext() const { return canvasBaseScriptExecutionContext(); }
    7878
    7979    CanvasRenderingContext* renderingContext() const;
    … …  
    9999
    100100protected:
    101     CanvasBase(ScriptExecutionContext*);
     101    CanvasBase();
     102
     103    virtual ScriptExecutionContext* canvasBaseScriptExecutionContext() const = 0;
    102104
    103105    std::unique_ptr<CanvasRenderingContext> m_context;
    … …  
    108110    bool m_didNotifyObserversCanvasDestroyed { false };
    109111#endif
    110     ScriptExecutionContext* m_scriptExecutionContext;
    111112    HashSet<CanvasObserver*> m_observers;
    112113};

  • branches/safari-607-branch/Source/WebCore/html/CustomPaintCanvas.cpp

    r238839 r245347  
    4040
    4141CustomPaintCanvas::CustomPaintCanvas(ScriptExecutionContext& context, unsigned width, unsigned height)
    42     : CanvasBase(&context)
     42    : ContextDestructionObserver(&context)
    4343    , m_size(width, height)
    4444{

  • branches/safari-607-branch/Source/WebCore/html/CustomPaintCanvas.h

    r238839 r245347  
    4545class PaintRenderingContext2D;
    4646
    47 class CustomPaintCanvas final : public RefCounted<CustomPaintCanvas>, public CanvasBase {
     47class CustomPaintCanvas final : public RefCounted<CustomPaintCanvas>, public CanvasBase, private ContextDestructionObserver {
    4848    WTF_MAKE_FAST_ALLOCATED;
    4949public:
    … …  
    8181    void refCanvasBase() final { ref(); }
    8282    void derefCanvasBase() final { deref(); }
     83    ScriptExecutionContext* canvasBaseScriptExecutionContext() const final { return ContextDestructionObserver::scriptExecutionContext(); }
    8384
    8485    mutable GraphicsContext* m_destinationGraphicsContext = nullptr;

  • branches/safari-607-branch/Source/WebCore/html/HTMLCanvasElement.cpp

    r241465 r245347  
    121121HTMLCanvasElement::HTMLCanvasElement(const QualifiedName& tagName, Document& document)
    122122    : HTMLElement(tagName, document)
    123     , CanvasBase(&document)
    124123    , m_size(defaultWidth, defaultHeight)
    125124{

  • branches/safari-607-branch/Source/WebCore/html/HTMLCanvasElement.h

    r239427 r245347  
    186186    void derefCanvasBase() final { HTMLElement::deref(); }
    187187
     188    ScriptExecutionContext* canvasBaseScriptExecutionContext() const final { return HTMLElement::scriptExecutionContext(); }
     189
    188190    FloatRect m_dirtyRect;
    189191    mutable IntSize m_size;

  • branches/safari-607-branch/Source/WebCore/html/OffscreenCanvas.cpp

    r237409 r245347  
    3939
    4040OffscreenCanvas::OffscreenCanvas(ScriptExecutionContext& context, unsigned width, unsigned height)
    41     : CanvasBase(&context)
     41    : ContextDestructionObserver(&context)
    4242    , m_size(width, height)
    4343{

  • branches/safari-607-branch/Source/WebCore/html/OffscreenCanvas.h

    r237344 r245347  
    4646#endif
    4747
    48 class OffscreenCanvas final : public RefCounted<OffscreenCanvas>, public CanvasBase, public EventTargetWithInlineData {
     48class OffscreenCanvas final : public RefCounted<OffscreenCanvas>, public CanvasBase, public EventTargetWithInlineData, private ContextDestructionObserver {
    4949    WTF_MAKE_FAST_ALLOCATED;
    5050public:
    … …  
    9595    bool isOffscreenCanvas() const final { return true; }
    9696
    97     ScriptExecutionContext* scriptExecutionContext() const final { return CanvasBase::scriptExecutionContext(); }
     97    ScriptExecutionContext* scriptExecutionContext() const final { return ContextDestructionObserver::scriptExecutionContext(); }
     98    ScriptExecutionContext* canvasBaseScriptExecutionContext() const final { return ContextDestructionObserver::scriptExecutionContext(); }
    9899
    99100    EventTargetInterface eventTargetInterface() const final { return OffscreenCanvasEventTargetInterfaceType; }
Note: See TracChangeset for help on using the changeset viewer.