Fixing bad casting between DOMTypedArray objects

third_party/WebKit/Source/core/html/ImageData.cpp

 /*
  * Copyright (C) 2008 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 268 matching lines @@
   else if (data.isFloat32Array())
     bufferView = data.getAsFloat32Array();
   else
     NOTREACHED();
 
   if (!ImageData::validateConstructorArguments(
           kParamData | kParamWidth | kParamHeight, nullptr, width, height,
           bufferView, &exceptionState))
     return nullptr;
 
-  return new ImageData(IntSize(width, height), bufferView, &colorSettings);
+  return new ImageData(IntSize(width, height), bufferView, &colorSettings,
+                       kStorageFormatFromBufferType);
 }
 
 ScriptPromise ImageData::createImageBitmap(ScriptState* scriptState,
                                            EventTarget& eventTarget,
                                            Optional<IntRect> cropRect,
                                            const ImageBitmapOptions& options,
                                            ExceptionState& exceptionState) {
   if ((cropRect &&
        !ImageBitmap::isSourceSizeValid(cropRect->width(), cropRect->height(),
                                        exceptionState)) ||
@@ skipping 69 matching lines @@
 
 void ImageData::trace(Visitor* visitor) {
   visitor->trace(m_data);
   visitor->trace(m_dataU16);
   visitor->trace(m_dataF32);
   visitor->trace(m_dataUnion);
 }
 
 ImageData::ImageData(const IntSize& size,
                      DOMArrayBufferView* data,
-                     const ImageDataColorSettings* colorSettings)
+                     const ImageDataColorSettings* colorSettings,
+                     StorageFormatSource storageFormatSource)
     : m_size(size) {
   DCHECK_GE(size.width(), 0);
   DCHECK_GE(size.height(), 0);
   DCHECK(data);
 
   m_data = nullptr;
   m_dataU16 = nullptr;
   m_dataF32 = nullptr;
 
   if (colorSettings) {
     m_colorSettings.setColorSpace(colorSettings->colorSpace());
     m_colorSettings.setStorageFormat(colorSettings->storageFormat());
   }
 
+  // if data is provided through the JS call, override the storage format.
+  if (storageFormatSource == kStorageFormatFromBufferType) {
+    switch (data->type()) {
+      case DOMArrayBufferView::ViewType::TypeUint8Clamped:
+        m_colorSettings.setStorageFormat(kUint8ClampedArrayStorageFormatName);
+        break;
+      case DOMArrayBufferView::ViewType::TypeUint16:
+        m_colorSettings.setStorageFormat(kUint16ArrayStorageFormatName);
+        break;
+      case DOMArrayBufferView::ViewType::TypeFloat32:
+        m_colorSettings.setStorageFormat(kFloat32ArrayStorageFormatName);
+        break;
+      default:
+        NOTREACHED();
+    }
+  }
+
   ImageDataStorageFormat storageFormat =
       getImageDataStorageFormat(m_colorSettings.storageFormat());
 
   switch (storageFormat) {
     case kUint8ClampedArrayStorageFormat:
+      DCHECK(data->type() == DOMArrayBufferView::ViewType::TypeUint8Clamped);
       m_data = const_cast<DOMUint8ClampedArray*>(
           static_cast<const DOMUint8ClampedArray*>(data));
+      DCHECK(m_data);
       m_dataUnion.setUint8ClampedArray(m_data);
       SECURITY_CHECK(static_cast<unsigned>(size.width() * size.height() * 4) <=
                      m_data->length());
       break;
 
     case kUint16ArrayStorageFormat:
+      DCHECK(data->type() == DOMArrayBufferView::ViewType::TypeUint16);
       m_dataU16 =
           const_cast<DOMUint16Array*>(static_cast<const DOMUint16Array*>(data));
+      DCHECK(m_dataU16);
       m_dataUnion.setUint16Array(m_dataU16);
       SECURITY_CHECK(static_cast<unsigned>(size.width() * size.height() * 4) <=
                      m_dataU16->length());
       break;
 
     case kFloat32ArrayStorageFormat:
+      DCHECK(data->type() == DOMArrayBufferView::ViewType::TypeFloat32);
       m_dataF32 = const_cast<DOMFloat32Array*>(
           static_cast<const DOMFloat32Array*>(data));
+      DCHECK(m_dataF32);
       m_dataUnion.setFloat32Array(m_dataF32);
       SECURITY_CHECK(static_cast<unsigned>(size.width() * size.height() * 4) <=
                      m_dataF32->length());
       break;
 
     default:
       NOTREACHED();
   }
 }
 
 }  // namespace blink