Skip to content

GitLab

T
tangled
Commit c3ef6722 authored by Nate Chapin's avatar Nate Chapin Committed by Commit Bot
Browse files
Options

Don't crash if HTMLCanvasElement::toBlob() is called in a detached document 

Bug: 1083623
Test: fast/canvas/canvas-toBlob-in-detached-document.html
Change-Id: I9286d6e6e568a1faf7dcb99e2ea4b252b88aff0b
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2207792
Commit-Queue: Kentaro Hara <haraken@chromium.org>
Auto-Submit: Nate Chapin <japhet@chromium.org>
Reviewed-by: default avatarKentaro Hara <haraken@chromium.org>
Cr-Commit-Position: refs/heads/master@{#769920}
parent 7a4d669b
Hide whitespace changes
Inline Side-by-side
Showing with 20 additions and 0 deletions
third_party/blink/renderer/core/html/canvas/canvas_async_blob_creator.cc
View file @ c3ef6722
...@@ -174,6 +174,7 @@ CanvasAsyncBlobCreator::CanvasAsyncBlobCreator( ...@@ -174,6 +174,7 @@ CanvasAsyncBlobCreator::CanvasAsyncBlobCreator(
callback_(callback), callback_(callback),
script_promise_resolver_(resolver) { script_promise_resolver_(resolver) {
DCHECK(image); DCHECK(image);
DCHECK(context);
mime_type_ = ImageEncoderUtils::ToEncodingMimeType( mime_type_ = ImageEncoderUtils::ToEncodingMimeType(
encode_options_->type(), encode_options_->type(),
......
third_party/blink/renderer/core/html/canvas/html_canvas_element.cc
View file @ c3ef6722
...@@ -1003,6 +1003,9 @@ void HTMLCanvasElement::toBlob(V8BlobCallback* callback, ...@@ -1003,6 +1003,9 @@ void HTMLCanvasElement::toBlob(V8BlobCallback* callback,
return; return;
} }
if (!GetExecutionContext())
return;
if (!IsPaintable()) { if (!IsPaintable()) {
// If the canvas element's bitmap has no pixels // If the canvas element's bitmap has no pixels
GetDocument() GetDocument()
......
third_party/blink/web_tests/fast/canvas/canvas-toBlob-in-detached-document.html 0 → 100644
View file @ c3ef6722
<body>
PASS if no crash.
<div id="d">
<iframe id="i"></iframe>
<canvas id="c"></canvas>
</div>
<script>
if (window.testRunner)
testRunner.dumpAsText();
var canvas = document.getElementById("c");
i.contentDocument.body.appendChild(d);
canvas.toBlob(() => {});
</script>
</body>
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment