| Index: third_party/WebKit/Source/core/html/HTMLImageElement.cpp
|
| diff --git a/third_party/WebKit/Source/core/html/HTMLImageElement.cpp b/third_party/WebKit/Source/core/html/HTMLImageElement.cpp
|
| index 6568ae88ae5097b7810ce79817c7b751a56dedb1..f1fed9601c61eea8650d6e53b48030f4e416452d 100644
|
| --- a/third_party/WebKit/Source/core/html/HTMLImageElement.cpp
|
| +++ b/third_party/WebKit/Source/core/html/HTMLImageElement.cpp
|
| @@ -699,7 +699,16 @@
|
| exceptionState.throwDOMException(IndexSizeError, String::format("The source %s provided is 0.", sw ? "height" : "width"));
|
| return ScriptPromise();
|
| }
|
| - return ImageBitmapSource::fulfillImageBitmap(scriptState, ImageBitmap::create(this, IntRect(sx, sy, sw, sh), eventTarget.toDOMWindow()->document()));
|
| + if (!cachedImage()->image()->currentFrameHasSingleSecurityOrigin()) {
|
| + exceptionState.throwSecurityError("The source image contains image data from multiple origins.");
|
| + return ScriptPromise();
|
| + }
|
| + Document* document = eventTarget.toDOMWindow()->document();
|
| + if (!cachedImage()->passesAccessControlCheck(document->securityOrigin()) && document->securityOrigin()->taintsCanvas(src())) {
|
| + exceptionState.throwSecurityError("Cross-origin access to the source image is denied.");
|
| + return ScriptPromise();
|
| + }
|
| + return ImageBitmapSource::fulfillImageBitmap(scriptState, ImageBitmap::create(this, IntRect(sx, sy, sw, sh)));
|
| }
|
|
|
| void HTMLImageElement::selectSourceURL(ImageLoader::UpdateFromElementBehavior behavior)
|
|
|