Disallow users modify canvas after it transfers control to offscreen

third_party/WebKit/Source/core/html/HTMLCanvasElement.cpp

 /*
  * Copyright (C) 2004, 2006, 2007 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Alp Toker <alp@atoker.com>
  * Copyright (C) 2010 Torch Mobile (Beijing) Co. Ltd. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
@@ skipping 156 matching lines @@
         return new LayoutHTMLCanvas(this);
     return HTMLElement::createLayoutObject(style);
 }
 
 Node::InsertionNotificationRequest HTMLCanvasElement::insertedInto(ContainerNode* node)
 {
     setIsInCanvasSubtree(true);
     return HTMLElement::insertedInto(node);
 }
 
-void HTMLCanvasElement::setHeight(int value)
+void HTMLCanvasElement::setHeight(int value, ExceptionState& exceptionState)
 {
+    if (surfaceLayerBridge()) {
+        // The existence of surfaceLayerBridge indicates that
+        // canvas.transferControlToOffscreen has been called.
+        exceptionState.throwDOMException(InvalidStateError, "Resizing is not allowed for a canvas that has transferred its control to offscreen.");
+        return;
+    }
     setIntegralAttribute(heightAttr, value);
 }
 
-void HTMLCanvasElement::setWidth(int value)
+void HTMLCanvasElement::setWidth(int value, ExceptionState& exceptionState)
 {
+    if (surfaceLayerBridge()) {
+        // Same comment as above.
+        exceptionState.throwDOMException(InvalidStateError, "Resizing is not allowed for a canvas that has transferred its control to offscreen.");
+        return;
+    }
     setIntegralAttribute(widthAttr, value);
 }
 
+void HTMLCanvasElement::setSize(const IntSize& newSize)
+{
+    if (newSize == size())
+        return;
+    m_ignoreReset = true;
+    setIntegralAttribute(widthAttr, newSize.width());
+    setIntegralAttribute(heightAttr, newSize.height());
+    m_ignoreReset = false;
+    reset();
+}
+
 HTMLCanvasElement::ContextFactoryVector& HTMLCanvasElement::renderingContextFactories()
 {
     DCHECK(isMainThread());
     DEFINE_STATIC_LOCAL(ContextFactoryVector, s_contextFactories, (CanvasRenderingContext::ContextTypeCount));
     return s_contextFactories;
 }
 
 CanvasRenderingContextFactory* HTMLCanvasElement::getRenderingContextFactory(int type)
 {
     DCHECK(type < CanvasRenderingContext::ContextTypeCount);
@@ skipping 436 matching lines @@
 
     String encodingMimeType = toEncodingMimeType(mimeType, EncodeReasonToDataURL);
 
     ImageData* imageData = toImageData(sourceBuffer, SnapshotReasonToDataURL);
 
     return ImageDataBuffer(imageData->size(), imageData->data()->data()).toDataURL(encodingMimeType, quality);
 }
 
 String HTMLCanvasElement::toDataURL(const String& mimeType, const ScriptValue& qualityArgument, ExceptionState& exceptionState) const
 {
+    if (surfaceLayerBridge()) {
+        exceptionState.throwDOMException(InvalidStateError, "canvas.toDataURL is not allowed for a canvas that has transferred its control to offscreen.");

[Justin Novosad, 2016/09/13 15:00:11]

No idea if this is what is causing the leak, but you need to return here.

+    }
     if (!originClean()) {
         exceptionState.throwSecurityError("Tainted canvases may not be exported.");
         return String();
     }
     Optional<ScopedUsHistogramTimer> timer;
     String lowercaseMimeType = mimeType.lower();
     if (mimeType.isNull())
         lowercaseMimeType = DefaultMimeType;
     if (lowercaseMimeType == "image/png") {
         DEFINE_THREAD_SAFE_STATIC_LOCAL(CustomCountHistogram, scopedUsCounterPNG, new CustomCountHistogram("Blink.Canvas.ToDataURL.PNG", 0, 10000000, 50));
@@ skipping 26 matching lines @@
         v8::Local<v8::Value> v8Value = qualityArgument.v8Value();
         if (v8Value->IsNumber()) {
             quality = v8Value.As<v8::Number>()->Value();
         }
     }
     return toDataURLInternal(mimeType, quality, BackBuffer);
 }
 
 void HTMLCanvasElement::toBlob(BlobCallback* callback, const String& mimeType, const ScriptValue& qualityArgument, ExceptionState& exceptionState)
 {
+    if (surfaceLayerBridge()) {
+        exceptionState.throwDOMException(InvalidStateError, "canvas.toBlob is not allowed for a canvas that has transferred its control to offscreen.");

[Justin Novosad, 2016/09/13 15:00:11]

You need to return here

+    }
+
     if (!originClean()) {
         exceptionState.throwSecurityError("Tainted canvases may not be exported.");
         return;
     }
 
     if (!isPaintable()) {
         // If the canvas element's bitmap has no pixels
         TaskRunnerHelper::get(TaskType::CanvasBlobSerialization, &document())->postTask(BLINK_FROM_HERE, WTF::bind(&BlobCallback::handleEvent, wrapPersistent(callback), nullptr));
         return;
     }
@@ skipping 314 matching lines @@
     DCHECK(m_context);
     DCHECK(m_context->getContextType() != CanvasRenderingContext::ContextImageBitmap);
     if (!hasImageBuffer() && !m_didFailToCreateImageBuffer)
         const_cast<HTMLCanvasElement*>(this)->createImageBuffer();
     return m_imageBuffer.get();
 }
 
 void HTMLCanvasElement::createImageBufferUsingSurfaceForTesting(std::unique_ptr<ImageBufferSurface> surface)
 {
     discardImageBuffer();
-    setWidth(surface->size().width());
-    setHeight(surface->size().height());
+    setIntegralAttribute(widthAttr, surface->size().width());
+    setIntegralAttribute(heightAttr, surface->size().height());
     createImageBufferInternal(std::move(surface));
 }
 
 void HTMLCanvasElement::ensureUnacceleratedImageBuffer()
 {
     DCHECK(m_context);
     if ((hasImageBuffer() && !m_imageBuffer->isAccelerated()) || m_didFailToCreateImageBuffer)
         return;
     discardImageBuffer();
     OpacityMode opacityMode = m_context->creationAttributes().alpha() ? NonOpaque : Opaque;
@@ skipping 217 matching lines @@
 
 bool HTMLCanvasElement::createSurfaceLayer()
 {
     DCHECK(!m_surfaceLayerBridge);
     std::unique_ptr<CanvasSurfaceLayerBridgeClient> bridgeClient = wrapUnique(new CanvasSurfaceLayerBridgeClientImpl());
     m_surfaceLayerBridge = wrapUnique(new CanvasSurfaceLayerBridge(std::move(bridgeClient)));
     return m_surfaceLayerBridge->createSurfaceLayer(this->width(), this->height());
 }
 
 } // namespace blink