Fixing bad casting between DOMTypedArray objects

third_party/WebKit/Source/core/html/ImageData.cpp

Index: third_party/WebKit/Source/core/html/ImageData.cpp
diff --git a/third_party/WebKit/Source/core/html/ImageData.cpp b/third_party/WebKit/Source/core/html/ImageData.cpp
index ffa7a11b3321b374ba458975db719add28c0ff2a..3630b6e097d7c4dcaa79e75f2f51d9c017d5e545 100644
--- a/third_party/WebKit/Source/core/html/ImageData.cpp
+++ b/third_party/WebKit/Source/core/html/ImageData.cpp
@@ -286,7 +286,8 @@ ImageData* ImageData::createImageData(
           bufferView, &exceptionState))
     return nullptr;
 
-  return new ImageData(IntSize(width, height), bufferView, &colorSettings);
+  return new ImageData(IntSize(width, height), bufferView, &colorSettings,
+                       kStorageFormatFromBufferType);
 }
 
 ScriptPromise ImageData::createImageBitmap(ScriptState* scriptState,
@@ -376,7 +377,8 @@ void ImageData::trace(Visitor* visitor) {
 
 ImageData::ImageData(const IntSize& size,
                      DOMArrayBufferView* data,
-                     const ImageDataColorSettings* colorSettings)
+                     const ImageDataColorSettings* colorSettings,
+                     StorageFormatSource storageFormatSource)
     : m_size(size) {
   DCHECK_GE(size.width(), 0);
   DCHECK_GE(size.height(), 0);
@@ -391,29 +393,52 @@ ImageData::ImageData(const IntSize& size,
     m_colorSettings.setStorageFormat(colorSettings->storageFormat());
   }
 
+  // if data is provided through the JS call, override the storage format.
+  if (storageFormatSource == kStorageFormatFromBufferType) {
+    switch (data->type()) {
+      case DOMArrayBufferView::ViewType::TypeUint8Clamped:
+        m_colorSettings.setStorageFormat(kUint8ClampedArrayStorageFormatName);
+        break;
+      case DOMArrayBufferView::ViewType::TypeUint16:
+        m_colorSettings.setStorageFormat(kUint16ArrayStorageFormatName);
+        break;
+      case DOMArrayBufferView::ViewType::TypeFloat32:
+        m_colorSettings.setStorageFormat(kFloat32ArrayStorageFormatName);
+        break;
+      default:
+        NOTREACHED();
+    }
+  }
+
   ImageDataStorageFormat storageFormat =
       getImageDataStorageFormat(m_colorSettings.storageFormat());
 
   switch (storageFormat) {
     case kUint8ClampedArrayStorageFormat:
+      DCHECK(data->type() == DOMArrayBufferView::ViewType::TypeUint8Clamped);
       m_data = const_cast<DOMUint8ClampedArray*>(
           static_cast<const DOMUint8ClampedArray*>(data));
+      DCHECK(m_data);
       m_dataUnion.setUint8ClampedArray(m_data);
       SECURITY_CHECK(static_cast<unsigned>(size.width() * size.height() * 4) <=
                      m_data->length());
       break;
 
     case kUint16ArrayStorageFormat:
+      DCHECK(data->type() == DOMArrayBufferView::ViewType::TypeUint16);
       m_dataU16 =
           const_cast<DOMUint16Array*>(static_cast<const DOMUint16Array*>(data));
+      DCHECK(m_dataU16);
       m_dataUnion.setUint16Array(m_dataU16);
       SECURITY_CHECK(static_cast<unsigned>(size.width() * size.height() * 4) <=
                      m_dataU16->length());
       break;
 
     case kFloat32ArrayStorageFormat:
+      DCHECK(data->type() == DOMArrayBufferView::ViewType::TypeFloat32);
       m_dataF32 = const_cast<DOMFloat32Array*>(
           static_cast<const DOMFloat32Array*>(data));
+      DCHECK(m_dataF32);
       m_dataUnion.setFloat32Array(m_dataF32);
       SECURITY_CHECK(static_cast<unsigned>(size.width() * size.height() * 4) <=
                      m_dataF32->length());