Diff
Modified: trunk/LayoutTests/ChangeLog (142050 => 142051)
--- trunk/LayoutTests/ChangeLog 2013-02-07 00:18:43 UTC (rev 142050)
+++ trunk/LayoutTests/ChangeLog 2013-02-07 00:28:13 UTC (rev 142051)
@@ -1,3 +1,21 @@
+2013-02-06 Dirk Schulze <dschu...@adobe.com>
+
+ Context's currentPath should check for passed type
+ https://bugs.webkit.org/show_bug.cgi?id=109097
+
+ Reviewed by Dean Jackson.
+
+ Add checks with different data types as value for canvas.currentPath.
+
+ * fast/canvas/canvas-currentPath-crash-expected.txt: Added.
+ * fast/canvas/canvas-currentPath-crash.html: Added.
+ * fast/canvas/script-tests/canvas-currentPath-crash.js: Added.
+ * platform/chromium/TestExpectations:
+ * platform/efl/TestExpectations:
+ * platform/gtk/TestExpectations:
+ * platform/mac/TestExpectations:
+ * platform/qt/TestExpectations:
+
2013-02-06 Stephen Chenney <schen...@chromium.org>
[Chromium] Test expectations update for Skia change.
Added: trunk/LayoutTests/fast/canvas/canvas-currentPath-crash-expected.txt (0 => 142051)
--- trunk/LayoutTests/fast/canvas/canvas-currentPath-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/canvas/canvas-currentPath-crash-expected.txt 2013-02-07 00:28:13 UTC (rev 142051)
@@ -0,0 +1,12 @@
+Series of tests to ensure that currentPath does not take non-Path values.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS imgdata[0] is 0
+PASS imgdata[1] is 128
+PASS imgdata[2] is 0
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/fast/canvas/canvas-currentPath-crash.html (0 => 142051)
--- trunk/LayoutTests/fast/canvas/canvas-currentPath-crash.html (rev 0)
+++ trunk/LayoutTests/fast/canvas/canvas-currentPath-crash.html 2013-02-07 00:28:13 UTC (rev 142051)
@@ -0,0 +1,9 @@
+<!doctype html>
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<script src=""
+<script src=""
+</body>
\ No newline at end of file
Added: trunk/LayoutTests/fast/canvas/script-tests/canvas-currentPath-crash.js (0 => 142051)
--- trunk/LayoutTests/fast/canvas/script-tests/canvas-currentPath-crash.js (rev 0)
+++ trunk/LayoutTests/fast/canvas/script-tests/canvas-currentPath-crash.js 2013-02-07 00:28:13 UTC (rev 142051)
@@ -0,0 +1,18 @@
+description("Series of tests to ensure that currentPath does not take non-Path values.");
+var ctx = document.createElement('canvas').getContext('2d');
+ctx.fillStyle = "green";
+ctx.beginPath();
+ctx.rect(0,0,100,100);
+
+ctx.currentPath = null;
+ctx.currentPath = 0;
+ctx.currentPath = {};
+ctx.currentPath = new Array();
+ctx.currentPath = undefined;
+
+ctx.fill();
+var imageData = ctx.getImageData(50, 50, 1, 1);
+var imgdata = imageData.data;
+shouldBe("imgdata[0]", "0");
+shouldBe("imgdata[1]", "128");
+shouldBe("imgdata[2]", "0");
\ No newline at end of file
Modified: trunk/LayoutTests/platform/chromium/TestExpectations (142050 => 142051)
--- trunk/LayoutTests/platform/chromium/TestExpectations 2013-02-07 00:18:43 UTC (rev 142050)
+++ trunk/LayoutTests/platform/chromium/TestExpectations 2013-02-07 00:28:13 UTC (rev 142051)
@@ -4231,6 +4231,12 @@
webkit.org/b/107508 platform/chromium/fast/forms/calendar-picker/calendar-picker-appearance-step.html [ ImageOnlyFailure Pass ]
webkit.org/b/107508 platform/chromium/fast/forms/calendar-picker/calendar-picker-appearance.html [ ImageOnlyFailure Pass ]
+# Rebaseline after currentPath
+webkit.org/b/108246 fast/canvas/canvas-currentPath.html [ Failure ]
+webkit.org/b/108246 platform/chromium/virtual/gpu/fast/canvas/canvas-currentPath.html [ Failure ]
+webkit.org/b/108246 fast/canvas/canvas-currentPath-crash.html [ Failure ]
+webkit.org/b/108246 platform/chromium/virtual/gpu/fast/canvas/canvas-currentPath-crash.html [ Failure ]
+
# Broken by Skia flag changes in r139445
crbug.com/169550 [ Debug ] fast/lists/big-list-marker.html [ Crash ]
crbug.com/169550 [ Debug ] platform/chromium/virtual/deferred/fast/images/icon-decoding.html [ Crash ]
Modified: trunk/LayoutTests/platform/efl/TestExpectations (142050 => 142051)
--- trunk/LayoutTests/platform/efl/TestExpectations 2013-02-07 00:18:43 UTC (rev 142050)
+++ trunk/LayoutTests/platform/efl/TestExpectations 2013-02-07 00:28:13 UTC (rev 142051)
@@ -1823,6 +1823,7 @@
# Remove from list after enabling CANVAS_PATH
webkit.org/b/108508 fast/canvas/canvas-path-constructors.html [ Failure ]
webkit.org/b/108508 fast/canvas/canvas-currentPath.html [ Failure ]
+webkit.org/b/108508 fast/canvas/canvas-currentPath-crash.html [ Failure ]
# Test fails on JSC platforms due to GC timing problems
webkit.org/b/106957 svg/dom/SVGViewSpec-invalid-ref-crash.html [ Failure ]
Modified: trunk/LayoutTests/platform/gtk/TestExpectations (142050 => 142051)
--- trunk/LayoutTests/platform/gtk/TestExpectations 2013-02-07 00:18:43 UTC (rev 142050)
+++ trunk/LayoutTests/platform/gtk/TestExpectations 2013-02-07 00:28:13 UTC (rev 142051)
@@ -1391,6 +1391,7 @@
# Remove from list after enabling CANVAS_PATH
webkit.org/b/108508 fast/canvas/canvas-currentPath.html [ Failure ]
webkit.org/b/108508 fast/canvas/canvas-path-constructors.html [ Failure ]
+webkit.org/b/108508 fast/canvas/canvas-currentPath-crash.html [ Failure ]
# volume is reset when mediaelement.src is modified
webkit.org/b/103893 media/video-volume.html [ Failure ]
Modified: trunk/LayoutTests/platform/mac/TestExpectations (142050 => 142051)
--- trunk/LayoutTests/platform/mac/TestExpectations 2013-02-07 00:18:43 UTC (rev 142050)
+++ trunk/LayoutTests/platform/mac/TestExpectations 2013-02-07 00:28:13 UTC (rev 142051)
@@ -147,6 +147,7 @@
# Remove from list after enabling CANVAS_PATH
fast/canvas/canvas-currentPath.html
fast/canvas/canvas-path-constructors.html
+fast/canvas/canvas-currentPath-crash.html
# This port doesn't support DeviceMotion or DeviceOrientation.
fast/dom/DeviceMotion
Modified: trunk/LayoutTests/platform/qt/TestExpectations (142050 => 142051)
--- trunk/LayoutTests/platform/qt/TestExpectations 2013-02-07 00:18:43 UTC (rev 142050)
+++ trunk/LayoutTests/platform/qt/TestExpectations 2013-02-07 00:28:13 UTC (rev 142051)
@@ -93,6 +93,7 @@
# Remove from list after enabling CANVAS_PATH
fast/canvas/canvas-currentPath.html
fast/canvas/canvas-path-constructors.html
+fast/canvas/canvas-currentPath-crash.html
# ENABLE(INPUT_SPEECH) is disabled.
fast/speech
Modified: trunk/Source/WebCore/ChangeLog (142050 => 142051)
--- trunk/Source/WebCore/ChangeLog 2013-02-07 00:18:43 UTC (rev 142050)
+++ trunk/Source/WebCore/ChangeLog 2013-02-07 00:28:13 UTC (rev 142051)
@@ -1,3 +1,17 @@
+2013-02-06 Dirk Schulze <dschu...@adobe.com>
+
+ Context's currentPath should check for passed type
+ https://bugs.webkit.org/show_bug.cgi?id=109097
+
+ Reviewed by Dean Jackson.
+
+ Add check for passed pointer and return earlier.
+
+ Test: fast/canvas/canvas-currentPath-crash.html
+
+ * html/canvas/CanvasRenderingContext2D.cpp:
+ (WebCore::CanvasRenderingContext2D::setCurrentPath):
+
2013-02-06 Rafael Weinstein <rafa...@chromium.org>
[HTMLTemplateElement] Non </template> end tags should be ignored in "template contents" insertion mode.
Modified: trunk/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp (142050 => 142051)
--- trunk/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp 2013-02-07 00:18:43 UTC (rev 142050)
+++ trunk/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp 2013-02-07 00:28:13 UTC (rev 142051)
@@ -867,6 +867,8 @@
void CanvasRenderingContext2D::setCurrentPath(DOMPath* path)
{
+ if (!path)
+ return;
m_path = path->path();
}
#endif
