Bug 22132 – All calls of ImageBuffer::create and ImageBuffer::copyImage should be null checked

• Status: RESOLVED
• Resolution: FIXED
• Component: Platform

[Brett Wilson (Google)]

Some calls of this function do not check the return value, or ASSERT that the return value is non-null. This can fail for a variety of legitimate reasons (the bitmap could be quite large in some cases, and there may not be enough resources to allocate it).

One example is CanvasRenderingContext2D::drawTextInternal which should just return if the call fails.

[Brent Fulgham]

This was the cause of Bug 146147.

[Brent Fulgham]

Created attachment 255193 [details]
Patch

[zalan]

Comment on attachment 255193 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=255193&action=review

> Source/WebCore/platform/graphics/BitmapImage.cpp:635
>          m_cachedImage = buffer->copyImage(DontCopyBackingStore, Unscaled);
> +        ASSERT(m_cachedImage);

nullptr is a valid return value of ImageBuffer::copyImage().

[Brent Fulgham]

Created attachment 255196 [details]
Patch

[Brent Fulgham]

Created attachment 255197 [details]
Patch

[Brent Fulgham]

Created attachment 255198 [details]
Patch v3 (Corrects merge conflict)

[Build Bot]

Comment on attachment 255198 [details]
Patch v3 (Corrects merge conflict)

Attachment 255198 [details] did not pass mac-ews (mac):
Output: http://webkit-queues.appspot.com/results/4611317411348480

New failing tests:
css3/masking/mask-repeat-space-padding.html
fast/borders/border-image-repeat-stretch.html
css3/blending/background-blend-mode-tiled-layers.html
css3/blending/background-blend-mode-data-uri-svg-image.html
css3/masking/mask-svg-no-fragmentId-tiled.html
css3/masking/mask-base64.html

[Build Bot]

Created attachment 255201 [details]
Archive of layout-test-results from ews100 for mac-mavericks

The attached test failures were seen while running run-webkit-tests on the mac-ews.
Bot: ews100  Port: mac-mavericks  Platform: Mac OS X 10.9.5

[Darin Adler]

Comment on attachment 255198 [details]
Patch v3 (Corrects merge conflict)

View in context: https://bugs.webkit.org/attachment.cgi?id=255198&action=review

Looks like this created some test failures. Please investigate why.

> Source/WebCore/platform/graphics/filters/FETile.cpp:76
> +    if (!pattern->tileImage())
> +        return;

I think it’s better to check the image for null before creating a Pattern with it. In the future, we might want to change Pattern to require a non-null image.

[Brent Fulgham]

(In reply to comment #9)
> Comment on attachment 255198 [details]
> Patch v3 (Corrects merge conflict)
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=255198&action=review
> 
> Looks like this created some test failures. Please investigate why.

Yes! I had flipped the null check in one case. I'll be uploading a new patch soon.

> > Source/WebCore/platform/graphics/filters/FETile.cpp:76
> > +    if (!pattern->tileImage())
> > +        return;
> 
> I think it’s better to check the image for null before creating a Pattern
> with it. In the future, we might want to change Pattern to require a
> non-null image.

Ok.

[Brent Fulgham]

Created attachment 255212 [details]
Patch v3 (Test Fix)

[Brent Fulgham]

Comment on attachment 255212 [details]
Patch v3 (Test Fix)

Updating with correction for tests. Waiting for EWS bots to review.

[Brent Fulgham]

Committed r185766: <http://trac.webkit.org/changeset/185766>

[Darin Adler]

Comment on attachment 255212 [details]
Patch v3 (Test Fix)

View in context: https://bugs.webkit.org/attachment.cgi?id=255212&action=review

> Source/WebCore/platform/graphics/filters/FETile.cpp:78
> +    auto pattern = Pattern::create(tileImageCopy, true, true);

Should be WTF::move(tileImageCopy), I think.

[Brent Fulgham]

(In reply to comment #14)
> Comment on attachment 255212 [details]
> Patch v3 (Test Fix)
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=255212&action=review
> 
> > Source/WebCore/platform/graphics/filters/FETile.cpp:78
> > +    auto pattern = Pattern::create(tileImageCopy, true, true);
> 
> Should be WTF::move(tileImageCopy), I think.

I'll checkin a fix. Thanks for catching that.

[Brent Fulgham]

Follow-up fix added in r185776. <https://trac.webkit.org/r185776>