Changeset 193500 in webkit

Timestamp:

Dec 4, 2015 5:45:33 PM (8 years ago)

Author:

Brent Fulgham

Message:

Place an upper bound on canvas pixel count
​https://bugs.webkit.org/show_bug.cgi?id=151825
<rdar://problem/23324916>

Reviewed by Simon Fraser.

Malformed JavaScript can attempt to create lots of canvas contexts. Limit the amount of memory
we will use for this purpose to some percentage of system RAM.

• html/HTMLCanvasElement.cpp:

(WebCore::removeFromActivePixelMemory): Added helper function
(WebCore::HTMLCanvasElement::~HTMLCanvasElement): Call new 'releaseImageBufferAndContext' method
to ensure ImageBuffer and graphics context state are properly cleaned up.
(WebCore::maxActivePixels): Use one quarter of the system RAM, or 1 GB (whichever is more) as
an upper bound on active pixel memory.
(WebCore::HTMLCanvasElement::getContext): If we are attempting to create a context that will cause
us to exceed the allowed active pixel count, fail.
(WebCore::HTMLCanvasElement::releaseImageBufferAndContext): Added helper function
(WebCore::HTMLCanvasElement::setSurfaceSize): Use the new 'releaseImageBufferAndContext' method
to handle active pixel memory counts.
(WebCore::HTMLCanvasElement::createImageBuffer): Refuse to create a backing buffer if it will
exceed our available pixel memory.

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• html/HTMLCanvasElement.cpp (modified) (10 diffs)
• html/HTMLCanvasElement.h (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2015-12-04  Brent Fulgham  <bfulgham@apple.com>
+
+        Place an upper bound on canvas pixel count
+        https://bugs.webkit.org/show_bug.cgi?id=151825
+        <rdar://problem/23324916>
+
+        Reviewed by Simon Fraser.
+
+        Malformed JavaScript can attempt to create lots of canvas contexts. Limit the amount of memory
+        we will use for this purpose to some percentage of system RAM.
+
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::removeFromActivePixelMemory): Added helper function
+        (WebCore::HTMLCanvasElement::~HTMLCanvasElement): Call new 'releaseImageBufferAndContext' method
+        to ensure ImageBuffer and graphics context state are properly cleaned up.
+        (WebCore::maxActivePixels): Use one quarter of the system RAM, or 1 GB (whichever is more) as
+        an upper bound on active pixel memory.
+        (WebCore::HTMLCanvasElement::getContext): If we are attempting to create a context that will cause
+        us to exceed the allowed active pixel count, fail.
+        (WebCore::HTMLCanvasElement::releaseImageBufferAndContext): Added helper function
+        (WebCore::HTMLCanvasElement::setSurfaceSize): Use the new 'releaseImageBufferAndContext' method
+        to handle active pixel memory counts.
+        (WebCore::HTMLCanvasElement::createImageBuffer): Refuse to create a backing buffer if it will
+        exceed our available pixel memory.
+
 2015-12-04  Brady Eidson  <beidson@apple.com>
 

trunk/Source/WebCore/html/HTMLCanvasElement.cpp

@@ -48 +48 @@
 #include "Settings.h"
 #include <math.h>
+#include <wtf/RAMSize.h>
 
 #include <runtime/JSCInlines.h>
@@ -76 +77 @@
 #endif
 
+static size_t activePixelMemory = 0;
+
 HTMLCanvasElement::HTMLCanvasElement(const QualifiedName& tagName, Document& document)
     : HTMLElement(tagName, document)
@@ -98 +101 @@
 }
 
+static void removeFromActivePixelMemory(size_t pixelsReleased)
+{
+    if (!pixelsReleased)
+        return;
+
+    if (pixelsReleased < activePixelMemory)
+        activePixelMemory -= pixelsReleased;
+    else
+        activePixelMemory = 0;
+}
+    
 HTMLCanvasElement::~HTMLCanvasElement()
 {
@@ -104 +118 @@
 
     m_context = nullptr; // Ensure this goes away before the ImageBuffer.
+
+    releaseImageBufferAndContext();
 }
 
@@ -179 +195 @@
 }
 #endif
+
+static inline size_t maxActivePixelMemory()
+{
+    static size_t maxPixelMemory;
+    static std::once_flag onceFlag;
+    std::call_once(onceFlag, [] {
+        maxPixelMemory = std::max(ramSize() / 4, 1024 * MB);
+    });
+    return maxPixelMemory;
+}
 
 CanvasRenderingContext* HTMLCanvasElement::getContext(const String& type, CanvasContextAttributes* attrs)
@@ -199 +225 @@
                 usesDashbardCompatibilityMode = settings->usesDashboardBackwardCompatibilityMode();
 #endif
+            size_t requestedPixelMemory = 4 * width() * height();
+            if (activePixelMemory + requestedPixelMemory > maxActivePixelMemory())
+                return nullptr;
+
             m_context = std::make_unique<CanvasRenderingContext2D>(this, document().inQuirksMode(), usesDashbardCompatibilityMode);
 #if USE(IOSURFACE_CANVAS_BACKING_STORE) || ENABLE(ACCELERATED_2D_CANVAS)
@@ -427 +457 @@
 }
 
+void HTMLCanvasElement::releaseImageBufferAndContext()
+{
+    m_contextStateSaver = nullptr;
+    setImageBuffer(nullptr);
+}
+    
 void HTMLCanvasElement::setSurfaceSize(const IntSize& size)
 {
     m_size = size;
     m_hasCreatedImageBuffer = false;
-    m_contextStateSaver = nullptr;
-    m_imageBuffer.reset();
+    releaseImageBufferAndContext();
     clearCopiedImage();
 }
@@ -572 +607 @@
         return;
     }
+    
+    // Make sure we don't use more pixel memory than the system can support.
+    size_t requestedPixelMemory = 4 * width() * height();
+    if (activePixelMemory + requestedPixelMemory > maxActivePixelMemory()) {
+        StringBuilder stringBuilder;
+        stringBuilder.appendLiteral("Total canvas memory use exceeds the maximum limit (");
+        stringBuilder.appendNumber(maxActivePixelMemory() / 1024 / 1024);
+        stringBuilder.appendLiteral(" MB).");
+        document().addConsoleMessage(MessageSource::JS, MessageLevel::Warning, stringBuilder.toString());
+        return;
+    }
 
     IntSize bufferSize(deviceSize.width(), deviceSize.height());
@@ -578 +624 @@
 
     RenderingMode renderingMode = shouldAccelerate(bufferSize) ? Accelerated : Unaccelerated;
-    m_imageBuffer = ImageBuffer::create(size(), renderingMode);
+
+    setImageBuffer(ImageBuffer::create(size(), renderingMode));
     if (!m_imageBuffer)
         return;
@@ -596 +643 @@
         const_cast<HTMLCanvasElement*>(this)->setNeedsStyleRecalc(SyntheticStyleChange);
 #endif
+}
+
+void HTMLCanvasElement::setImageBuffer(std::unique_ptr<ImageBuffer> buffer) const
+{
+    removeFromActivePixelMemory(memoryCost());
+
+    m_imageBuffer = WTF::move(buffer);
+
+    activePixelMemory += memoryCost();
 }
 

trunk/Source/WebCore/html/HTMLCanvasElement.h

@@ -153 +153 @@
 
     void setSurfaceSize(const IntSize&);
+    void setImageBuffer(std::unique_ptr<ImageBuffer>) const;
+    void releaseImageBufferAndContext();
 
     bool paintsIntoCanvasBuffer() const;