Closed Bug 1585142 Opened 11 months ago Closed 10 months ago

[wpt-sync] Sync PR 19413 - [OT-PW] Fixes crash when drawing patterns

Categories

(Core :: Web Painting, task, P4)

task

Tracking

()

RESOLVED FIXED
mozilla71
Tracking Status
firefox71 --- fixed

People

(Reporter: mozilla.org, Unassigned)

References

()

Details

(Whiteboard: [wptsync downstream])

Sync web-platform-tests PR 19413 into mozilla-central (this bug is closed when the sync is complete).

PR: https://github.com/web-platform-tests/wpt/pull/19413
Details from upstream follow.

Xida Chen <xidachen@chromium.org> wrote:

[OT-PW] Fixes crash when drawing patterns

Right now the PaintWorkletDeferredImage keeps a scoped_refptr to the
PaintWorkletInput, and during the CreateShader function, the ownership
of that PaintWorkletInput is given to a PaintImage, which is then used
to create a PaintShader.

Notice that the CreateShader function can be called multiple times,
and in this case the PaintWorkletInput is nullptr after the first call.
And then it triggers a crash in PaintShader::MakeImage.

To fix this, we make the PaintWorkletDeferredImage keeps a PaintImage
which would always own the PaintWorkletInput that is passed to it.
When CreateShader is called, we can use the PaintImage to build the
shader.

A layout test is added to ensure there is no crash.

Bug: 1009450
Change-Id: I8fa5f45728884fe213176b4f5490329259a19a27
Reviewed-on: https://chromium-review.googlesource.com/1831790
WPT-Export-Revision: 865ac6a2347c1cbb6a06ef7bcb8ed1b3497a28de

Component: web-platform-tests → Web Painting
Product: Testing → Core
Ran 1 tests
FAIL   : 1

New tests that have failures or other problems:
/css/css-paint-api/geometry-border-image-005.https.html: FAIL
Pushed by wptsync@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/cfd6f7a92945
[wpt PR 19413] - [OT-PW] Fixes crash when drawing patterns, a=testonly
https://hg.mozilla.org/integration/mozilla-inbound/rev/19a49bcb64b5
[wpt PR 19413] - Update wpt metadata, a=testonly
Status: NEW → RESOLVED
Closed: 10 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla71
You need to log in before you can comment on or make changes to this bug.