Bug 421715: canvas crash passing undefined to putImageData, r+a=vlad

2008-03-10 00:35:37 -07:00 · 2008-03-10 00:35:37 -07:00 · be6fb851ef
--- a/content/canvas/crashtests/421715-1.html
+++ b/content/canvas/crashtests/421715-1.html
@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <script type="text/javascript">
+      function stringify(a) {
+        if (a)
+          return a.toSource();
+        return ''+a;
+      }
+      var args = [undefined, null, [], {}, 0, "0"];
+      var stringArgs = args.map(stringify);
+
+      function test_method(context, method, arity) {
+        function testParams(existingParams, depth) {
+          for each (var arg in stringArgs) {
+            var code = "context[method](" + existingParams + arg + ")";
+            try {
+              eval(code);
+            } catch (ex) {
+              // Exceptions are expected
+            }
+
+            if (depth < arity)
+              testParams(existingParams + arg + ",", depth + 1);
+          }
+        }
+        testParams("", 1);
+      }
+
+      function startTest() {
+        var canvas = document.getElementById("img");
+        var context = canvas.getContext('2d');;
+        test_method(context, "getImageData", 4);
+        test_method(context, "putImageData", 3);
+      }
+    </script>
+  </head>
+  <body onload="startTest()">
+    <canvas id="img">No canvas support.</canvas>
+  </body>
+</html>
--- a/content/canvas/crashtests/crashtests.list
+++ b/content/canvas/crashtests/crashtests.list
@ -0,0 +1 @@
+load 421715-1.html
--- a/content/canvas/src/nsCanvasRenderingContext2D.cpp
+++ b/content/canvas/src/nsCanvasRenderingContext2D.cpp
@ -2548,6 +2548,9 @@ nsCanvasRenderingContext2D::PutImageData()
    if (!JS_ConvertArguments (ctx, argc, argv, "ojj", &dataObject, &x, &y))
        return NS_ERROR_DOM_SYNTAX_ERR;

+    if (!dataObject)
+        return NS_ERROR_DOM_SYNTAX_ERR;
+
    int32 w, h;
    JSObject *dataArray;
    jsval v;
--- a/testing/crashtest/crashtests.list
+++ b/testing/crashtest/crashtests.list
@ -4,6 +4,7 @@
 include ../../testing/crashtest/sanity/crashtests.list

 include ../../content/base/crashtests/crashtests.list
+include ../../content/canvas/crashtests/crashtests.list
 include ../../content/html/document/crashtests/crashtests.list
 include ../../content/html/content/crashtests/crashtests.list
 include ../../content/svg/content/src/crashtests/crashtests.list