Bug 1797099 - Ensure the SurfacePattern transform is invertible. r=aosmond

Differential Revision: https://phabricator.services.mozilla.com/D160091
2022-10-25 17:42:05 +00:00 · 2022-10-25 17:42:05 +00:00 · 1ca676e9e2
--- a/dom/canvas/DrawTargetWebgl.cpp
+++ b/dom/canvas/DrawTargetWebgl.cpp
@ -1784,6 +1784,12 @@ bool DrawTargetWebgl::SharedContext::DrawRectAccel(
        }
      }

+      // We need to be able to transform from local space into texture space.
+      Matrix invMatrix = surfacePattern.mMatrix;
+      if (!invMatrix.Invert()) {
+        break;
+      }
+
      RefPtr<WebGLTextureJS> tex;
      IntRect bounds;
      IntSize backingSize;
@ -1988,7 +1994,7 @@ bool DrawTargetWebgl::SharedContext::DrawRectAccel(
      // the backing texture subrect.
      Size backingSizeF(backingSize);
      Matrix uvMatrix(aRect.width, 0.0f, 0.0f, aRect.height, aRect.x, aRect.y);
-      uvMatrix *= surfacePattern.mMatrix.Inverse();
+      uvMatrix *= invMatrix;
      uvMatrix *= Matrix(1.0f / backingSizeF.width, 0.0f, 0.0f,
                         1.0f / backingSizeF.height,
                         float(bounds.x - offset.x) / backingSizeF.width,
--- a/gfx/tests/crashtests/1797099-1.html
+++ b/gfx/tests/crashtests/1797099-1.html
@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <script>
+      document.addEventListener('DOMContentLoaded', () => {
+        const canvas = document.createElementNS('http://www.w3.org/1999/xhtml', 'canvas')
+        const context = canvas.getContext('2d')
+        const pattern = context.createPattern(canvas, 'no-repeat')
+        context.fillStyle = pattern
+        pattern.setTransform({
+          'c': 1.510601806598101,
+          'd': 0,
+        })
+        context.fillRect(1024, 512, 32, 32767)
+      })
+    </script>
+</head>
+</html>
--- a/gfx/tests/crashtests/crashtests.list
+++ b/gfx/tests/crashtests/crashtests.list
@ -221,3 +221,4 @@ pref(layout.css.backdrop-filter.enabled,true) load 1771556.html
 pref(layout.css.backdrop-filter.enabled,true) load 1771561.html
 load 1780567.html
 load 1681955.html
+load 1797099-1.html