drawImage throw when ImageBitmap is neutered

third_party/WebKit/Source/modules/canvas2d/BaseRenderingContext2D.cpp

Index: third_party/WebKit/Source/modules/canvas2d/BaseRenderingContext2D.cpp
diff --git a/third_party/WebKit/Source/modules/canvas2d/BaseRenderingContext2D.cpp b/third_party/WebKit/Source/modules/canvas2d/BaseRenderingContext2D.cpp
index 4c3f5f306b0f063272e0c5e3b6a02d28f50e878a..05cb0e501d8ad6a828ebeda134dc11b2106de734 100644
--- a/third_party/WebKit/Source/modules/canvas2d/BaseRenderingContext2D.cpp
+++ b/third_party/WebKit/Source/modules/canvas2d/BaseRenderingContext2D.cpp
@@ -853,9 +853,20 @@ static inline CanvasImageSource* toImageSourceInternal(const CanvasImageSourceUn
     return nullptr;
 }
 
+static bool imageSourceNeutered(CanvasImageSource* imageSource, ExceptionState& exceptionState)

[Justin Novosad, 2016/04/21 20:45:19]

I think you should put this inside toImageSourceInternal, make that function
throw and return NULL if neutered.

[xidachen, 2016/04/22 01:58:13]

Done.

+{
+    if (imageSource->isImageBitmap() && static_cast<ImageBitmap*>(imageSource)->isNeutered()) {
+        exceptionState.throwDOMException(InvalidStateError, String::format("The image source is neutered"));
+        return true;
+    }
+    return false;
+}
+
 void BaseRenderingContext2D::drawImage(const CanvasImageSourceUnion& imageSource, double x, double y, ExceptionState& exceptionState)
 {
     CanvasImageSource* imageSourceInternal = toImageSourceInternal(imageSource);
+    if (imageSourceNeutered(imageSourceInternal, exceptionState))
+        return;
     FloatSize defaultObjectSize(width(), height());
     FloatSize sourceRectSize = imageSourceInternal->elementSize(defaultObjectSize);
     FloatSize destRectSize = imageSourceInternal->defaultDestinationSize(defaultObjectSize);
@@ -866,6 +877,8 @@ void BaseRenderingContext2D::drawImage(const CanvasImageSourceUnion& imageSource
     double x, double y, double width, double height, ExceptionState& exceptionState)
 {
     CanvasImageSource* imageSourceInternal = toImageSourceInternal(imageSource);
+    if (imageSourceNeutered(imageSourceInternal, exceptionState))
+        return;
     FloatSize defaultObjectSize(this->width(), this->height());
     FloatSize sourceRectSize = imageSourceInternal->elementSize(defaultObjectSize);
     drawImage(imageSourceInternal, 0, 0, sourceRectSize.width(), sourceRectSize.height(), x, y, width, height, exceptionState);
@@ -876,6 +889,8 @@ void BaseRenderingContext2D::drawImage(const CanvasImageSourceUnion& imageSource
     double dx, double dy, double dw, double dh, ExceptionState& exceptionState)
 {
     CanvasImageSource* imageSourceInternal = toImageSourceInternal(imageSource);
+    if (imageSourceNeutered(imageSourceInternal, exceptionState))
+        return;
     drawImage(imageSourceInternal, sx, sy, sw, sh, dx, dy, dw, dh, exceptionState);
 }