Bug 1357092 - Make EnsureWritablePath() always try to create a mPathBuilder, also when we don't have a valid target (i.e. for sErrorTarget). r=mstange

MozReview-Commit-ID: AzyZOpsIdwA
2017-04-18 00:56:34 +02:00 · 2017-04-18 00:56:34 +02:00 · b73a39811b
--- a/dom/canvas/CanvasRenderingContext2D.cpp
+++ b/dom/canvas/CanvasRenderingContext2D.cpp
@ -3801,9 +3801,8 @@ void
 CanvasRenderingContext2D::EnsureWritablePath()
 {
  EnsureTarget();
-  if (!IsTargetValid()) {
-    return;
-  }
+  // NOTE: IsTargetValid() may be false here (mTarget == sErrorTarget) but we
+  // go ahead and create a path anyway since callers depend on that.

  if (mDSPathBuilder) {
    return;
--- a/dom/canvas/crashtests/1357092.html
+++ b/dom/canvas/crashtests/1357092.html
@ -0,0 +1,10 @@
+<html>
+    <head>
+        <script>
+            o1 = document.createElement("canvas");
+            o1.setAttribute("width", "100000");
+            o2 = o1.getContext("2d");
+            o2.bezierCurveTo(64, 1, 1, 1, 1, 1);
+        </script>
+    </head>
+</html>
--- a/dom/canvas/crashtests/crashtests.list
+++ b/dom/canvas/crashtests/crashtests.list
@ -42,4 +42,4 @@ load 1305312-1.html
 load 1298576-1.html
 load 1334366-1.html
 load 1334647-1.html
-
+load 1357092.html