drawImage throw when ImageBitmap is neutered

third_party/WebKit/Source/modules/canvas2d/BaseRenderingContext2D.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "modules/canvas2d/BaseRenderingContext2D.h"
 
 #include "bindings/core/v8/ExceptionMessages.h"
 #include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/ExceptionStatePlaceholder.h"
 #include "core/css/parser/CSSParser.h"
@@ skipping 835 matching lines @@
     if (value.isHTMLVideoElement())
         return value.getAsHTMLVideoElement();
     if (value.isHTMLCanvasElement())
         return value.getAsHTMLCanvasElement();
     if (value.isImageBitmap())
         return value.getAsImageBitmap();
     ASSERT_NOT_REACHED();
     return nullptr;
 }
 
+static bool imageSourceNeutered(CanvasImageSource* imageSource, ExceptionState& exceptionState)

[Justin Novosad, 2016/04/21 20:45:19]

I think you should put this inside toImageSourceInternal, make that function
throw and return NULL if neutered.

[xidachen, 2016/04/22 01:58:13]

Done.

+{
+    if (imageSource->isImageBitmap() && static_cast<ImageBitmap*>(imageSource)->isNeutered()) {
+        exceptionState.throwDOMException(InvalidStateError, String::format("The image source is neutered"));
+        return true;
+    }
+    return false;
+}
+
 void BaseRenderingContext2D::drawImage(const CanvasImageSourceUnion& imageSource, double x, double y, ExceptionState& exceptionState)
 {
     CanvasImageSource* imageSourceInternal = toImageSourceInternal(imageSource);
+    if (imageSourceNeutered(imageSourceInternal, exceptionState))
+        return;
     FloatSize defaultObjectSize(width(), height());
     FloatSize sourceRectSize = imageSourceInternal->elementSize(defaultObjectSize);
     FloatSize destRectSize = imageSourceInternal->defaultDestinationSize(defaultObjectSize);
     drawImage(imageSourceInternal, 0, 0, sourceRectSize.width(), sourceRectSize.height(), x, y, destRectSize.width(), destRectSize.height(), exceptionState);
 }
 
 void BaseRenderingContext2D::drawImage(const CanvasImageSourceUnion& imageSource,
     double x, double y, double width, double height, ExceptionState& exceptionState)
 {
     CanvasImageSource* imageSourceInternal = toImageSourceInternal(imageSource);
+    if (imageSourceNeutered(imageSourceInternal, exceptionState))
+        return;
     FloatSize defaultObjectSize(this->width(), this->height());
     FloatSize sourceRectSize = imageSourceInternal->elementSize(defaultObjectSize);
     drawImage(imageSourceInternal, 0, 0, sourceRectSize.width(), sourceRectSize.height(), x, y, width, height, exceptionState);
 }
 
 void BaseRenderingContext2D::drawImage(const CanvasImageSourceUnion& imageSource,
     double sx, double sy, double sw, double sh,
     double dx, double dy, double dw, double dh, ExceptionState& exceptionState)
 {
     CanvasImageSource* imageSourceInternal = toImageSourceInternal(imageSource);
+    if (imageSourceNeutered(imageSourceInternal, exceptionState))
+        return;
     drawImage(imageSourceInternal, sx, sy, sw, sh, dx, dy, dw, dh, exceptionState);
 }
 
 bool BaseRenderingContext2D::shouldDrawImageAntialiased(const FloatRect& destRect) const
 {
     if (!state().shouldAntialias())
         return false;
     SkCanvas* c = drawingCanvas();
     ASSERT(c);
 
@@ skipping 189 matching lines @@
     return gradient;
 }
 
 CanvasPattern* BaseRenderingContext2D::createPattern(const CanvasImageSourceUnion& imageSource, const String& repetitionType, ExceptionState& exceptionState)
 {
     Pattern::RepeatMode repeatMode = CanvasPattern::parseRepetitionType(repetitionType, exceptionState);
     if (exceptionState.hadException())
         return nullptr;
 
     SourceImageStatus status;
     CanvasImageSource* imageSourceInternal = toImageSourceInternal(imageSource);

[Justin Novosad, 2016/04/21 20:45:19]

You forgot about this guy.

[xidachen, 2016/04/22 01:58:13]

Done.

     FloatSize defaultObjectSize(width(), height());
     RefPtr<Image> imageForRendering = imageSourceInternal->getSourceImageForCanvas(&status, PreferNoAcceleration, SnapshotReasonCreatePattern, defaultObjectSize);
 
     switch (status) {
     case NormalSourceImageStatus:
         break;
     case ZeroSizeCanvasSourceImageStatus:
         exceptionState.throwDOMException(InvalidStateError, String::format("The canvas %s is 0.", imageSourceInternal->elementSize(defaultObjectSize).width() ? "height" : "width"));
         return nullptr;
     case UndecodableSourceImageStatus:
@@ skipping 274 matching lines @@
 
     imageBuffer()->willOverwriteCanvas();
 }
 
 DEFINE_TRACE(BaseRenderingContext2D)
 {
     visitor->trace(m_stateStack);
 }
 
 } // namespace blink