[PE] Distinguish between tainting due to canvas content and filter.

A filter on a canvas can itself lead to origin tainting, for reasons
other than that the canvas contents are tainted. This CL changes
to distinguish these two causes, so that we recompute filters
on content-tainting change.

Bug: 778506
Change-Id: I3cec8ef3b2772f2af78cdd4b290520113092cca6
Reviewed-on: https://chromium-review.googlesource.com/811767Reviewed-by: Fredrik Söderquist <fs@opera.com>
Commit-Queue: Chris Harrelson <chrishtr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#522274}

third_party/WebKit/LayoutTests/http/tests/css3/filters/fedisplacementmap-tainted.html

@@ -17,7 +17,8 @@ img.src = "http://localhost:8000/resources/square.png";
 img.onload = function () {
   var ctx = document.getElementById("canvas").getContext("2d");
   ctx.filter = "url(#filter)";
-
+  // Fill rect will force resolving of the filter before drawImage.
+  ctx.fillRect(-10, -10, 1, 1);
   ctx.drawImage(img, 0, 0);
   window.testRunner.notifyDone();
 }

third_party/WebKit/Source/modules/canvas/canvas2d/BaseRenderingContext2D.cpp

@@ -45,7 +45,7 @@ const char BaseRenderingContext2D::kLtrDirectionString[] = "ltr";
 const double BaseRenderingContext2D::kCDeviceScaleFactor = 1.0;
 
 BaseRenderingContext2D::BaseRenderingContext2D()
-    : clip_antialiasing_(kNotAntiAliased) {
+    : clip_antialiasing_(kNotAntiAliased), origin_tainted_by_content_(false) {
   state_stack_.push_back(CanvasRenderingContext2DState::Create());
 }
 
@@ -151,6 +151,7 @@ void BaseRenderingContext2D::Reset() {
 #endif
   }
   ValidateStateStack();
+  origin_tainted_by_content_ = false;
 }
 
 static inline void ConvertCanvasStyleToUnionType(
@@ -195,10 +196,8 @@ void BaseRenderingContext2D::setStrokeStyle(
   } else if (style.IsCanvasPattern()) {
     CanvasPattern* canvas_pattern = style.GetAsCanvasPattern();
 
-    if (OriginClean() && !canvas_pattern->OriginClean()) {
-      SetOriginTainted();
-      ClearResolvedFilters();
-    }
+    if (!origin_tainted_by_content_ && !canvas_pattern->OriginClean())
+      SetOriginTaintedByContent();
 
     canvas_style = CanvasStyle::CreateFromPattern(canvas_pattern);
   }
@@ -238,9 +237,8 @@ void BaseRenderingContext2D::setFillStyle(
   } else if (style.IsCanvasPattern()) {
     CanvasPattern* canvas_pattern = style.GetAsCanvasPattern();
 
-    if (OriginClean() && !canvas_pattern->OriginClean()) {
-      SetOriginTainted();
-      ClearResolvedFilters();
+    if (!origin_tainted_by_content_ && !canvas_pattern->OriginClean()) {
+      SetOriginTaintedByContent();
     }
     if (canvas_pattern->GetPattern()->IsTextureBacked())
       DisableDeferral(kDisableDeferralReasonUsingTextureBackedPattern);
@@ -1107,7 +1105,9 @@ bool ShouldDisableDeferral(CanvasImageSource* image_source,
   return false;
 }
 
-void BaseRenderingContext2D::ClearResolvedFilters() {
+void BaseRenderingContext2D::SetOriginTaintedByContent() {
+  SetOriginTainted();
+  origin_tainted_by_content_ = true;
   for (auto& state : state_stack_)
     state->ClearResolvedFilter();
 }
@@ -1274,11 +1274,9 @@ void BaseRenderingContext2D::drawImage(ScriptState* script_state,
 
   ValidateStateStack();
 
-  if (OriginClean() &&
-      WouldTaintOrigin(image_source, ExecutionContext::From(script_state))) {
-    SetOriginTainted();
-    ClearResolvedFilters();
-  }
+  if (!origin_tainted_by_content_ &&
+      WouldTaintOrigin(image_source, ExecutionContext::From(script_state)))
+    SetOriginTaintedByContent();
 
   Draw(
       [this, &image_source, &image, &src_rect, dst_rect](

third_party/WebKit/Source/modules/canvas/canvas2d/BaseRenderingContext2D.h

@@ -410,9 +410,14 @@ class MODULES_EXPORT BaseRenderingContext2D : public GarbageCollectedMixin,
 
   void ClearCanvas();
   bool RectContainsTransformedRect(const FloatRect&, const SkIRect&) const;
-  void ClearResolvedFilters();
+  // Sets the origin to be tainted by the content of the canvas, such
+  // as a cross-origin image. This is as opposed to some other reason
+  // such as tainting from a filter applied to the canvas.
+  void SetOriginTaintedByContent();
 
   ImageDataColorSettings GetColorSettingsAsImageDataColorSettings() const;
+
+  bool origin_tainted_by_content_;
 };
 
 template <typename DrawFunc, typename ContainsFunc>