Changeset 139144 in webkit

Timestamp:

Jan 8, 2013 6:30:03 PM (11 years ago)

Author:

junov@google.com

Message:

CanvasRenderingContext2D::setFont argument may reference destroyed object
​https://bugs.webkit.org/show_bug.cgi?id=106385

Reviewed by Abhishek Arya.

No new tests: covered by fast/canvas/canvas-measureText.html

This is a re-write of r138994. Fixing bug in setFont instead of
workaround at call site.

• html/canvas/CanvasRenderingContext2D.cpp:

(WebCore::CanvasRenderingContext2D::setFont):
(WebCore::CanvasRenderingContext2D::accessFont):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• html/canvas/CanvasRenderingContext2D.cpp (modified) (2 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2013-01-08  Justin Novosad  <junov@google.com>
+
+        CanvasRenderingContext2D::setFont argument may reference destroyed object
+        https://bugs.webkit.org/show_bug.cgi?id=106385
+
+        Reviewed by Abhishek Arya.
+
+        No new tests: covered by fast/canvas/canvas-measureText.html
+
+        This is a re-write of r138994.  Fixing bug in setFont instead of
+        workaround at call site. 
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::setFont):
+        (WebCore::CanvasRenderingContext2D::accessFont):
+
 2013-01-08  David Grogan  <dgrogan@chromium.org>
 

trunk/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp

@@ -2089 +2089 @@
 
     // The parse succeeded.
-    realizeSaves();
-    modifiableState().m_unparsedFont = newFont;
+    String newFontSafeCopy(newFont); // Create a string copy since newFont can be deleted inside realizeSaves.
+    realizeSaves();
+    modifiableState().m_unparsedFont = newFontSafeCopy;
 
     // Map the <canvas> font into the text style. If the font uses keywords like larger/smaller, these will work
@@ -2374 +2375 @@
     canvas()->document()->updateStyleIfNeeded();
 
-    if (!state().m_realizedFont) {
-        // Create temporary string object to hold ref count in case
-        // state().m_unparsedFont in unreffed by call to realizeSaves in
-        // setFont.
-        String unparsedFont(state().m_unparsedFont);
-        setFont(unparsedFont);
-    }
+    if (!state().m_realizedFont)
+        setFont(state().m_unparsedFont);
     return state().m_font;
 }