Skip to content

GitLab

T
tangled
Commit b059a760 authored by Stephen Chenney's avatar Stephen Chenney Committed by Commit Bot
Browse files
Options

Handle failed allocations for raster shapes 

Code checks for the size when allocating a raster shape
(for CSS shape-outside) but ASAN defeats this check by
allocating more than the exact image size. Be robust to
this case and other out-of-memory situations by handling
failed allocations.

R=fs@opera.com
BUG=779366

Change-Id: I11b1f9baaac21d89044dbaa1d5ed6cd188ccc813
Reviewed-on: https://chromium-review.googlesource.com/749320Reviewed-by: default avatarFredrik Söderquist <fs@opera.com>
Commit-Queue: Stephen Chenney <schenney@chromium.org>
Cr-Commit-Position: refs/heads/master@{#513251}
parent ab1386fb
Hide whitespace changes
Inline Side-by-side
Showing with 82 additions and 5 deletions
third_party/WebKit/LayoutTests/fast/shapes/crash-allocating-very-large-raster-shape.html 0 → 100644
View file @ b059a760
<!-- Without the the associated fix, crashes only in Win 32 ASAN. -->
<!-- The exact width of the column also matters. -->
<script>
if (window.testRunner) {
testRunner.dumpAsText();
}
</script>
<style>
* {
/* Margin size is important. Just enough to crash but not enough to hit
the check for "too big to allocate an image"
*/
margin: 41310px auto 90 auto;
shape-outside: url("data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg'></svg>");
}
</style>
<body style="column-width:24em; column-gap:2em">
<div style="float:left;">
<div>A
<p>B
<p>C
<p>D
<p>E
<p>F
<p>G
<p>H
<p>I
<p>KKKKKKKKKKKKKKKKKKKKKKKKK
<p>L
<p>M
</p>
</p>
</p>
</p>
</p>
</p>
</p>
</p>
</p>
</p>
</p>
</div>
</div>
</body>
third_party/WebKit/Source/core/layout/shapes/Shape.cpp
View file @ b059a760
...@@ -256,8 +256,10 @@ std::unique_ptr<Shape> Shape::CreateRasterShape(Image* image, ...@@ -256,8 +256,10 @@ std::unique_ptr<Shape> Shape::CreateRasterShape(Image* image,
Image::kDoNotClampImageToSourceRect, Image::kSyncDecode); Image::kDoNotClampImageToSourceRect, Image::kSyncDecode);
WTF::ArrayBufferContents contents; WTF::ArrayBufferContents contents;
image_buffer->GetImageData(IntRect(IntPoint(), image_rect.Size()), bool image_data_exists = image_buffer->GetImageData(
contents); IntRect(IntPoint(), image_rect.Size()), contents);
if (!image_data_exists)
return nullptr;
DOMArrayBuffer* array_buffer = DOMArrayBuffer::Create(contents); DOMArrayBuffer* array_buffer = DOMArrayBuffer::Create(contents);
DOMUint8ClampedArray* pixel_array = DOMUint8ClampedArray::Create( DOMUint8ClampedArray* pixel_array = DOMUint8ClampedArray::Create(
array_buffer, 0, array_buffer->ByteLength()); array_buffer, 0, array_buffer->ByteLength());
......
third_party/WebKit/Source/core/layout/shapes/ShapeOutsideInfo.cpp
View file @ b059a760
...@@ -172,9 +172,16 @@ std::unique_ptr<Shape> ShapeOutsideInfo::CreateShapeForImage( ...@@ -172,9 +172,16 @@ std::unique_ptr<Shape> ShapeOutsideInfo::CreateShapeForImage(
layout_box_, layout_box_.GetDocument(), layout_box_.StyleRef(), layout_box_, layout_box_.GetDocument(), layout_box_.StyleRef(),
FlooredIntSize(image_size), nullptr); FlooredIntSize(image_size), nullptr);
return Shape::CreateRasterShape(image.get(), shape_image_threshold, std::unique_ptr<Shape> new_shape =
image_rect, margin_rect, writing_mode, Shape::CreateRasterShape(image.get(), shape_image_threshold, image_rect,
margin); margin_rect, writing_mode, margin);
if (!new_shape) {
layout_box_.GetDocument().AddConsoleMessage(
ConsoleMessage::Create(kRenderingMessageSource, kErrorMessageLevel,
"The shape-outside image is too large."));
return Shape::CreateEmptyRasterShape(writing_mode, margin);
}
return new_shape;
} }
const Shape& ShapeOutsideInfo::ComputedShape() const { const Shape& ShapeOutsideInfo::ComputedShape() const {
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment