canvas: calling toDataURL without context doesn't create a buffer of canvas 2d.

Source/core/html/HTMLCanvasElement.cpp

Index: Source/core/html/HTMLCanvasElement.cpp
diff --git a/Source/core/html/HTMLCanvasElement.cpp b/Source/core/html/HTMLCanvasElement.cpp
index 0c2e016f5a37b52b713efadfedaaa698a737ddc0..4194576bfe663da40695f117babccc4487846fb2 100644
--- a/Source/core/html/HTMLCanvasElement.cpp
+++ b/Source/core/html/HTMLCanvasElement.cpp
@@ -62,17 +62,32 @@ namespace blink {
 
 using namespace HTMLNames;
 
+namespace {
+
 // These values come from the WhatWG spec.
-static const int DefaultWidth = 300;
-static const int DefaultHeight = 150;
+const int DefaultWidth = 300;
+const int DefaultHeight = 150;
 
 // Firefox limits width/height to 32767 pixels, but slows down dramatically before it
 // reaches that limit. We limit by area instead, giving us larger maximum dimensions,
 // in exchange for a smaller maximum canvas size.
-static const int MaxCanvasArea = 32768 * 8192; // Maximum canvas area in CSS pixels
+const int MaxCanvasArea = 32768 * 8192; // Maximum canvas area in CSS pixels
 
 //In Skia, we will also limit width/height to 32767.
-static const int MaxSkiaDim = 32767; // Maximum width/height in CSS pixels.
+const int MaxSkiaDim = 32767; // Maximum width/height in CSS pixels.
+
+bool canCreateImageBuffer(const IntSize& deviceSize)
+{
+    if (deviceSize.width() * deviceSize.height() > MaxCanvasArea)
+        return false;
+    if (deviceSize.width() > MaxSkiaDim || deviceSize.height() > MaxSkiaDim)
+        return false;
+    if (!deviceSize.width() || !deviceSize.height())
+        return false;
+    return true;
+}
+
+} // namespace
 
 DEFINE_EMPTY_DESTRUCTOR_WILL_BE_REMOVED(CanvasObserver);
 
@@ -395,10 +410,14 @@ const AtomicString HTMLCanvasElement::imageSourceURL() const
 
 String HTMLCanvasElement::toDataURLInternal(const String& mimeType, const double* quality, bool isSaving) const
 {
-    if (m_size.isEmpty() || !buffer())
+    if (m_size.isEmpty() || !canCreateImageBuffer(size()))
         return String("data:,");
 
     String encodingMimeType = toEncodingMimeType(mimeType);
+    if (!m_context) {
+        RefPtrWillBeRawPtr<ImageData> imageData = ImageData::create(m_size);

[Noel Gordon, 2015/01/06 10:43:58]

/me poking around here because ...

Cluster fuzz produced a complaint about toDataURL after this patch: did you guys
get bug mail at all?

Drive-by comment: If a user has never called getContext("2d") or
getContext("3d") on their canvas (m_context has not been created), why should
toDataURL even attempt to return an image, which the code seems to be doing
here? What does Mozilla do? /me curious.

[dshwang, 2015/01/06 11:55:56]

thx for noting.
 
I guess http://crbug.com/445848 
if there is another issue, plz let me know. anyway, it's not easy for me to
imagine how this commit causes fuzz test failure.
all browsers return transparent image.
we discussed about it at msg #2 and #3

On 2014/11/24 17:20:57, junov wrote:
the
I agree on you. We should preserve the existing behavior.
For example, MDN HTMLCanvasElement.toDataURL show the following example,
https://developer.mozilla.org/en-US/docs/Web/API/HTMLCanvasElement.toDataURL

<canvas id="canvas" width="5" height="5"></canvas>
var canvas = document.getElementById("canvas");
var dataURL = canvas.toDataURL();
console.log(dataURL);
// "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAUAAAAFCAYAAACNby
// blAAAADElEQVQImWNgoBMAAABpAAFEI8ARAAAAAElFTkSuQmCC"

+        return ImageDataToDataURL(ImageDataBuffer(imageData->size(), imageData->data()), encodingMimeType, quality);
+    }
 
     // Try to get ImageData first, as that may avoid lossy conversions.
     RefPtrWillBeRawPtr<ImageData> imageData = getImageData();
@@ -406,7 +425,7 @@ String HTMLCanvasElement::toDataURLInternal(const String& mimeType, const double
     if (imageData)
         return ImageDataToDataURL(ImageDataBuffer(imageData->size(), imageData->data()), encodingMimeType, quality);
 
-    if (m_context && m_context->is3d()) {
+    if (m_context->is3d()) {
         m_context->paintRenderingResultsToCanvas(isSaving ? CanvasRenderingContext::Front : CanvasRenderingContext::Back);
     }
 
@@ -556,18 +575,11 @@ void HTMLCanvasElement::createImageBufferInternal()
     m_didFailToCreateImageBuffer = true;
     m_imageBufferIsClear = true;
 
-    IntSize deviceSize = size();
-    if (deviceSize.width() * deviceSize.height() > MaxCanvasArea)
-        return;
-
-    if (deviceSize.width() > MaxSkiaDim || deviceSize.height() > MaxSkiaDim)
-        return;
-
-    if (!deviceSize.width() || !deviceSize.height())
+    if (!canCreateImageBuffer(size()))
         return;
 
     int msaaSampleCount;
-    OwnPtr<ImageBufferSurface> surface = createImageBufferSurface(deviceSize, &msaaSampleCount);
+    OwnPtr<ImageBufferSurface> surface = createImageBufferSurface(size(), &msaaSampleCount);
     if (!surface->isValid())
         return;