Context's currentPath should check for passed type
authorcommit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 7 Feb 2013 00:28:13 +0000 (00:28 +0000)
committercommit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 7 Feb 2013 00:28:13 +0000 (00:28 +0000)
https://bugs.webkit.org/show_bug.cgi?id=109097

Patch by Dirk Schulze <dschulze@adobe.com> on 2013-02-06
Reviewed by Dean Jackson.

Source/WebCore:

Add check for passed pointer and return earlier.

Test: fast/canvas/canvas-currentPath-crash.html

* html/canvas/CanvasRenderingContext2D.cpp:
(WebCore::CanvasRenderingContext2D::setCurrentPath):

LayoutTests:

Add checks with different data types as value for canvas.currentPath.

* fast/canvas/canvas-currentPath-crash-expected.txt: Added.
* fast/canvas/canvas-currentPath-crash.html: Added.
* fast/canvas/script-tests/canvas-currentPath-crash.js: Added.
* platform/chromium/TestExpectations:
* platform/efl/TestExpectations:
* platform/gtk/TestExpectations:
* platform/mac/TestExpectations:
* platform/qt/TestExpectations:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@142051 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/fast/canvas/canvas-currentPath-crash-expected.txt [new file with mode: 0644]
LayoutTests/fast/canvas/canvas-currentPath-crash.html [new file with mode: 0644]
LayoutTests/fast/canvas/script-tests/canvas-currentPath-crash.js [new file with mode: 0644]
LayoutTests/platform/chromium/TestExpectations
LayoutTests/platform/efl/TestExpectations
LayoutTests/platform/gtk/TestExpectations
LayoutTests/platform/mac/TestExpectations
LayoutTests/platform/qt/TestExpectations
Source/WebCore/ChangeLog
Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp

index 85c7764..74cb46d 100644 (file)
@@ -1,3 +1,21 @@
+2013-02-06  Dirk Schulze  <dschulze@adobe.com>
+
+        Context's currentPath should check for passed type
+        https://bugs.webkit.org/show_bug.cgi?id=109097
+
+        Reviewed by Dean Jackson.
+
+        Add checks with different data types as value for canvas.currentPath.
+
+        * fast/canvas/canvas-currentPath-crash-expected.txt: Added.
+        * fast/canvas/canvas-currentPath-crash.html: Added.
+        * fast/canvas/script-tests/canvas-currentPath-crash.js: Added.
+        * platform/chromium/TestExpectations:
+        * platform/efl/TestExpectations:
+        * platform/gtk/TestExpectations:
+        * platform/mac/TestExpectations:
+        * platform/qt/TestExpectations:
+
 2013-02-06  Stephen Chenney  <schenney@chromium.org>
 
         [Chromium] Test expectations update for Skia change.
diff --git a/LayoutTests/fast/canvas/canvas-currentPath-crash-expected.txt b/LayoutTests/fast/canvas/canvas-currentPath-crash-expected.txt
new file mode 100644 (file)
index 0000000..c285659
--- /dev/null
@@ -0,0 +1,12 @@
+Series of tests to ensure that currentPath does not take non-Path values.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS imgdata[0] is 0
+PASS imgdata[1] is 128
+PASS imgdata[2] is 0
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/fast/canvas/canvas-currentPath-crash.html b/LayoutTests/fast/canvas/canvas-currentPath-crash.html
new file mode 100644 (file)
index 0000000..632c4ad
--- /dev/null
@@ -0,0 +1,9 @@
+<!doctype html>
+<html>
+<head>
+<script src="../js/resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="script-tests/canvas-currentPath-crash.js"></script>
+<script src="../js/resources/js-test-post.js"></script>
+</body>
\ No newline at end of file
diff --git a/LayoutTests/fast/canvas/script-tests/canvas-currentPath-crash.js b/LayoutTests/fast/canvas/script-tests/canvas-currentPath-crash.js
new file mode 100644 (file)
index 0000000..31fab8d
--- /dev/null
@@ -0,0 +1,18 @@
+description("Series of tests to ensure that currentPath does not take non-Path values.");
+var ctx = document.createElement('canvas').getContext('2d');
+ctx.fillStyle = "green";
+ctx.beginPath();
+ctx.rect(0,0,100,100);
+
+ctx.currentPath = null;
+ctx.currentPath = 0;
+ctx.currentPath = {};
+ctx.currentPath = new Array();
+ctx.currentPath = undefined;
+
+ctx.fill();
+var imageData = ctx.getImageData(50, 50, 1, 1);
+var imgdata = imageData.data;
+shouldBe("imgdata[0]", "0");
+shouldBe("imgdata[1]", "128");
+shouldBe("imgdata[2]", "0");
\ No newline at end of file
index 407c87c..182c087 100644 (file)
@@ -4231,6 +4231,12 @@ webkit.org/b/107508 platform/chromium/fast/forms/calendar-picker/month-picker-ap
 webkit.org/b/107508 platform/chromium/fast/forms/calendar-picker/calendar-picker-appearance-step.html [ ImageOnlyFailure Pass ]
 webkit.org/b/107508 platform/chromium/fast/forms/calendar-picker/calendar-picker-appearance.html [ ImageOnlyFailure Pass ]
 
+# Rebaseline after currentPath
+webkit.org/b/108246 fast/canvas/canvas-currentPath.html [ Failure ]
+webkit.org/b/108246 platform/chromium/virtual/gpu/fast/canvas/canvas-currentPath.html [ Failure ]
+webkit.org/b/108246 fast/canvas/canvas-currentPath-crash.html [ Failure ]
+webkit.org/b/108246 platform/chromium/virtual/gpu/fast/canvas/canvas-currentPath-crash.html [ Failure ]
+
 # Broken by Skia flag changes in r139445
 crbug.com/169550 [ Debug ] fast/lists/big-list-marker.html [ Crash ]
 crbug.com/169550 [ Debug ] platform/chromium/virtual/deferred/fast/images/icon-decoding.html [ Crash ]
index 0b4d5a1..c7cbf69 100644 (file)
@@ -1823,6 +1823,7 @@ inspector/editor/text-editor-word-jumps.html
 # Remove from list after enabling CANVAS_PATH
 webkit.org/b/108508 fast/canvas/canvas-path-constructors.html [ Failure ]
 webkit.org/b/108508 fast/canvas/canvas-currentPath.html [ Failure ]
+webkit.org/b/108508 fast/canvas/canvas-currentPath-crash.html [ Failure ]
 
 # Test fails on JSC platforms due to GC timing problems
 webkit.org/b/106957 svg/dom/SVGViewSpec-invalid-ref-crash.html [ Failure ]
index 54ce358..a7aa1d5 100644 (file)
@@ -1391,6 +1391,7 @@ webkit.org/b/103740 editing/selection/caret-alignment-for-vertical-text.html [ F
 # Remove from list after enabling CANVAS_PATH
 webkit.org/b/108508 fast/canvas/canvas-currentPath.html [ Failure ]
 webkit.org/b/108508 fast/canvas/canvas-path-constructors.html [ Failure ]
+webkit.org/b/108508 fast/canvas/canvas-currentPath-crash.html [ Failure ]
 
 # volume is reset when mediaelement.src is modified
 webkit.org/b/103893 media/video-volume.html [ Failure ]
index 3e3d4c4..bf67f23 100644 (file)
@@ -147,6 +147,7 @@ http/tests/security/no-indexeddb-from-sandbox.html
 # Remove from list after enabling CANVAS_PATH
 fast/canvas/canvas-currentPath.html
 fast/canvas/canvas-path-constructors.html
+fast/canvas/canvas-currentPath-crash.html
 
 # This port doesn't support DeviceMotion or DeviceOrientation.
 fast/dom/DeviceMotion
index 6e3a876..a536e6d 100644 (file)
@@ -93,6 +93,7 @@ gamepad/
 # Remove from list after enabling CANVAS_PATH
 fast/canvas/canvas-currentPath.html
 fast/canvas/canvas-path-constructors.html
+fast/canvas/canvas-currentPath-crash.html
 
 # ENABLE(INPUT_SPEECH) is disabled.
 fast/speech
index 98148a4..5d208bb 100644 (file)
@@ -1,3 +1,17 @@
+2013-02-06  Dirk Schulze  <dschulze@adobe.com>
+
+        Context's currentPath should check for passed type
+        https://bugs.webkit.org/show_bug.cgi?id=109097
+
+        Reviewed by Dean Jackson.
+
+        Add check for passed pointer and return earlier.
+
+        Test: fast/canvas/canvas-currentPath-crash.html
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::setCurrentPath):
+
 2013-02-06  Rafael Weinstein  <rafaelw@chromium.org>
 
         [HTMLTemplateElement] Non </template> end tags should be ignored in "template contents" insertion mode.
index 39394f4..4575cdb 100644 (file)
@@ -867,6 +867,8 @@ PassRefPtr<DOMPath> CanvasRenderingContext2D::currentPath()
 
 void CanvasRenderingContext2D::setCurrentPath(DOMPath* path)
 {
+    if (!path)
+        return;
     m_path = path->path();
 }
 #endif