Change code path for structured cloning ImageBitmap

third_party/WebKit/Source/bindings/core/v8/ScriptValueSerializer.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "bindings/core/v8/ScriptValueSerializer.h"
 
 #include "bindings/core/v8/Transferables.h"
 #include "bindings/core/v8/V8ArrayBuffer.h"
 #include "bindings/core/v8/V8ArrayBufferView.h"
 #include "bindings/core/v8/V8Blob.h"
@@ skipping 294 matching lines @@
     doWriteUint32(pixelDataLength);
     append(pixelData, pixelDataLength);
 }
 
 void SerializedScriptValueWriter::writeImageData(uint32_t width, uint32_t height, const uint8_t* pixelData, uint32_t pixelDataLength)
 {
     append(ImageDataTag);
     doWriteImageData(width, height, pixelData, pixelDataLength);
 }
 
-void SerializedScriptValueWriter::writeImageBitmap(uint32_t width, uint32_t height, uint32_t isOriginClean, const uint8_t* pixelData, uint32_t pixelDataLength)
+void SerializedScriptValueWriter::writeImageBitmap(uint32_t width, uint32_t height, uint32_t isOriginClean, uint32_t isPremultiplied, const uint8_t* pixelData, uint32_t pixelDataLength)
 {
     append(ImageBitmapTag);
     append(isOriginClean);
+    append(isPremultiplied);
     doWriteImageData(width, height, pixelData, pixelDataLength);
 }
 
 void SerializedScriptValueWriter::writeRegExp(v8::Local<v8::String> pattern, v8::RegExp::Flags flags)
 {
     append(RegExpTag);
     v8::String::Utf8Value patternUtf8Value(pattern);
     doWriteString(*patternUtf8Value, patternUtf8Value.length());
     doWriteUint32(static_cast<uint32_t>(flags));
 }
@@ skipping 809 matching lines @@
     if (!imageBitmap)
         return nullptr;
     if (imageBitmap->isNeutered())
         return handleError(Status::DataCloneError, "An ImageBitmap is detached and could not be cloned.", next);
 
     uint32_t index;
     if (m_transferredImageBitmaps.tryGet(object, &index)) {
         m_writer.writeTransferredImageBitmap(index);
     } else {
         greyObject(object);
-        std::unique_ptr<uint8_t[]> pixelData = imageBitmap->copyBitmapData(PremultiplyAlpha);
-        m_writer.writeImageBitmap(imageBitmap->width(), imageBitmap->height(), static_cast<uint32_t>(imageBitmap->originClean()), pixelData.get(), imageBitmap->width() * imageBitmap->height() * 4);
+        std::unique_ptr<uint8_t[]> pixelData = imageBitmap->copyBitmapData(imageBitmap->isPremultiplied() ? PremultiplyAlpha : DontPremultiplyAlpha);
+        m_writer.writeImageBitmap(imageBitmap->width(), imageBitmap->height(), static_cast<uint32_t>(imageBitmap->originClean()), static_cast<uint32_t>(imageBitmap->isPremultiplied()), pixelData.get(), imageBitmap->width() * imageBitmap->height() * 4);
     }
     return nullptr;
 }
 
 void ScriptValueSerializer::writeRegExp(v8::Local<v8::Value> value)
 {
     v8::Local<v8::RegExp> regExp = value.As<v8::RegExp>();
     m_writer.writeRegExp(regExp->GetSource(), regExp->GetFlags());
 }
 
@@ skipping 581 matching lines @@
 
 bool SerializedScriptValueReader::readNumberObject(v8::Local<v8::Value>* value)
 {
     double number;
     if (!doReadNumber(&number))
         return false;
     *value = v8::NumberObject::New(isolate(), number);
     return true;
 }
 
-// Helper function shared by readImageData and readImageBitmap
-ImageData* SerializedScriptValueReader::doReadImageData()
+// Helper function used by readImageData and readImageBitmap.
+bool SerializedScriptValueReader::doReadImageDataProperties(uint32_t* width, uint32_t* height, uint32_t* pixelDataLength)
+{
+    if (!doReadUint32(width))
+        return false;
+    if (!doReadUint32(height))
+        return false;
+    if (!doReadUint32(pixelDataLength))
+        return false;
+    if (m_position + *pixelDataLength > m_length)

[jbroman, 2016/06/28 18:50:22]

nit: Not introduced in this CL, but beware of overflow here.

Something like "m_position >= m_length || m_length - m_position <
*pixelDataLength" might be safer, because it doesn't cause overflow in the case
where m_position and m_length are close are close to
std::numeric_limits<unsigned>::max().

[xidachen, 2016/06/29 12:58:35]

Done.

+        return false;
+    return true;
+}
+
+bool SerializedScriptValueReader::readImageData(v8::Local<v8::Value>* value)
 {
     uint32_t width;
     uint32_t height;
     uint32_t pixelDataLength;
-    if (!doReadUint32(&width))
-        return nullptr;
-    if (!doReadUint32(&height))
-        return nullptr;
-    if (!doReadUint32(&pixelDataLength))
-        return nullptr;
-    if (m_position + pixelDataLength > m_length)
-        return nullptr;
+    if (!doReadImageDataProperties(&width, &height, &pixelDataLength))
+        return false;
     ImageData* imageData = ImageData::create(IntSize(width, height));
     DOMUint8ClampedArray* pixelArray = imageData->data();
     ASSERT(pixelArray);
     ASSERT(pixelArray->length() >= pixelDataLength);
     memcpy(pixelArray->data(), m_buffer + m_position, pixelDataLength);
     m_position += pixelDataLength;
-    return imageData;
-}
-
-bool SerializedScriptValueReader::readImageData(v8::Local<v8::Value>* value)
-{
-    ImageData* imageData = doReadImageData();
     if (!imageData)
         return false;
     *value = toV8(imageData, m_scriptState->context()->Global(), isolate());
     return !value->IsEmpty();
 }
 
 bool SerializedScriptValueReader::readImageBitmap(v8::Local<v8::Value>* value)
 {
     uint32_t isOriginClean;
     if (!doReadUint32(&isOriginClean))
         return false;
-    ImageData* imageData = doReadImageData();
-    if (!imageData)
+    uint32_t isPremultiplied;
+    if (!doReadUint32(&isPremultiplied))
         return false;
-    ImageBitmapOptions options;
-    options.setPremultiplyAlpha("none");
-    ImageBitmap* imageBitmap = ImageBitmap::create(imageData, IntRect(0, 0, imageData->width(), imageData->height()), options, true, isOriginClean);
+    uint32_t width;
+    uint32_t height;
+    uint32_t pixelDataLength;
+    if (!doReadImageDataProperties(&width, &height, &pixelDataLength))
+        return false;
+    std::unique_ptr<uint8_t[]> pixelData = wrapArrayUnique(new uint8_t[pixelDataLength]);
+    DCHECK(pixelData);

[jbroman, 2016/06/28 18:50:21]

DCHECK isn't necessary here; the renderer will crash if the allocation fails.

[xidachen, 2016/06/29 12:58:35]

Done.

+    memcpy(pixelData.get(), m_buffer + m_position, pixelDataLength);
+    m_position += pixelDataLength;
+    ImageBitmap* imageBitmap = ImageBitmap::create(std::move(pixelData), width, height, isPremultiplied, isOriginClean);
     if (!imageBitmap)
         return false;
     *value = toV8(imageBitmap, m_scriptState->context()->Global(), isolate());
     return !value->IsEmpty();
 }
 
 bool SerializedScriptValueReader::readCompositorProxy(v8::Local<v8::Value>* value)
 {
     uint32_t attributes;
     uint64_t element;
@@ skipping 638 matching lines @@
         return false;
     uint32_t objectReference = m_openCompositeReferenceStack[m_openCompositeReferenceStack.size() - 1];
     m_openCompositeReferenceStack.shrink(m_openCompositeReferenceStack.size() - 1);
     if (objectReference >= m_objectPool.size())
         return false;
     *object = m_objectPool[objectReference];
     return true;
 }
 
 } // namespace blink