Changeset 198243 in webkit

Timestamp:

Mar 15, 2016 4:59:24 PM (8 years ago)

Author:

Simon Fraser

Message:

Occasional crash under GraphicsContext::platformContext() when dragging Google maps
​https://bugs.webkit.org/show_bug.cgi?id=155521
rdar://problem/24357307

Reviewed by Tim Horton.

It's possible for createDragImageForSelection() to return a null image, if the bounds
of the selection are an empty rect. That would cause a crash under convertImageToBitmap()
because a zero-sized ShareableBitmap will return a null GraphicsContext.

To avoid this, early return from DragController::startDrag() if the dragImage is null.

I wasn't able to come up with a test for this.

• page/DragController.cpp:

(WebCore::DragController::startDrag):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• page/DragController.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2016-03-15  Simon Fraser  <simon.fraser@apple.com>
+
+        Occasional crash under GraphicsContext::platformContext when dragging Google maps
+        https://bugs.webkit.org/show_bug.cgi?id=155521
+        rdar://problem/24357307
+
+        Reviewed by Tim Horton.
+
+        It's possible for createDragImageForSelection() to return a null image, if the bounds
+        of the selection are an empty rect. That would cause a crash under convertImageToBitmap()
+        because a zero-sized ShareableBitmap will return a null GraphicsContext.
+        
+        To avoid this, early return from DragController::startDrag() if the dragImage is null.
+        
+        I wasn't able to come up with a test for this.
+
+        * page/DragController.cpp:
+        (WebCore::DragController::startDrag):
+
 2016-03-15  Tim Horton  <timothy_horton@apple.com>
 

trunk/Source/WebCore/page/DragController.cpp

@@ -839 +839 @@
             m_dragOffset = IntPoint(dragOrigin.x() - dragLoc.x(), dragOrigin.y() - dragLoc.y());
         }
+
+        if (!dragImage)
+            return false;
+
         doSystemDrag(dragImage, dragLoc, dragOrigin, dataTransfer, src, false);
     } else if (!src.document()->securityOrigin()->canDisplay(linkURL)) {