Bug 17303: Canvas crash in ImageBuffer

Reviewed by Hyatt.

We handle a null GraphicsContext everywhere, but we weren't checking for
a null ImageBuffer, which is what will result in a null GraphicsContext in
the first place.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@30452 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 5e06169..a30b4b1 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,12 @@
+2008-02-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Hyatt.
+
+        Test to ensure we do not crash on a zero sized canvas.
+
+        * fast/canvas/access-zero-sized-canvas-expected.txt: Added.
+        * fast/canvas/access-zero-sized-canvas.html: Added.
+
 2008-02-20  Alexey Proskuryakov  <ap@webkit.org>
 
         Reviewed by Darin.

diff --git a/LayoutTests/fast/canvas/access-zero-sized-canvas-expected.txt b/LayoutTests/fast/canvas/access-zero-sized-canvas-expected.txt
new file mode 100644 (file)
index 0000000..228b9ad
--- /dev/null
+++ b/LayoutTests/fast/canvas/access-zero-sized-canvas-expected.txt
@@ -0,0 +1,2 @@
+This test ensures that accessing the context of a zero sized canvas does not crash. 
+

diff --git a/LayoutTests/fast/canvas/access-zero-sized-canvas.html b/LayoutTests/fast/canvas/access-zero-sized-canvas.html
new file mode 100644 (file)
index 0000000..33524da
--- /dev/null
+++ b/LayoutTests/fast/canvas/access-zero-sized-canvas.html
@@ -0,0 +1,10 @@
+This test ensures that accessing the context of a zero sized canvas does not crash.
+<canvas id="canvas" width="0" height="0"></canvas><br />
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+var context = document.getElementById("canvas").getContext("2d");
+context.fillStyle = "green";
+
+</script>

diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 8e9c436..793b697 100644 (file)
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,17 @@
+2008-02-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Hyatt.
+
+        Bug 17303: Canvas crash in ImageBuffer
+
+        We handle a null GraphicsContext everywhere, but we weren't checking for 
+        a null ImageBuffer, which is what will result in a null GraphicsContext in
+        the first place.
+
+        Test: fast/canvas/access-zero-sized-canvas.html
+
+        * html/HTMLCanvasElement.cpp:
+
 2008-02-20  David Hyatt  <hyatt@apple.com>
 
         Fix the layout test failure that never should have passed in the first

diff --git a/WebCore/html/HTMLCanvasElement.cpp b/WebCore/html/HTMLCanvasElement.cpp
index b8eb0c5..d711fbf 100644 (file)
--- a/WebCore/html/HTMLCanvasElement.cpp
+++ b/WebCore/html/HTMLCanvasElement.cpp
@@ -208,7 +208,7 @@ void HTMLCanvasElement::createImageBuffer() const
 
 GraphicsContext* HTMLCanvasElement::drawingContext() const
 {
-    return buffer()->context();
+    return buffer() ? m_imageBuffer->context() : 0;
 }
 
 ImageBuffer* HTMLCanvasElement::buffer() const