1995659 - Duplicate ArrayBuffers in ImageDecoder transfer not detected

Status: RESOLVED FIXED

(Core :: Audio/Video: Web Codecs, defect)

Description

[Leo Tenenbaum]

Steps to reproduce:

Run the following JavaScript code:

  // 1x1 pixel black PNG file
  let data = new Uint8Array([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0x00, 0x00, 0x00, 0x0d,
    0x49, 0x48, 0x44, 0x52, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01,
    0x01, 0x00, 0x00, 0x00, 0x00, 0x37, 0x6e, 0xf9, 0x24, 0x00, 0x00, 0x00,
    0x0a, 0x49, 0x44, 0x41, 0x54, 0x78, 0x01, 0x63, 0x60, 0x00, 0x00, 0x00,
    0x02, 0x00, 0x01, 0x73, 0x75, 0x01, 0x18, 0x00, 0x00, 0x00, 0x00, 0x49,
    0x45, 0x4e, 0x44, 0xae, 0x42, 0x60, 0x82]).buffer;
  new ImageDecoder({type: "image/png", data, transfer: [data, data]});

Actual results:

No error is thrown.

Expected results:

An error should be thrown due to the second reference to data in transfer (see WebCodecs § 10.2.2.2). Currently there's some code which is supposed to handle this but it's broken due to comparing pointers to elements of the aInit.mTransfer array, rather than the pointers to the objects themselves.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::Audio/Video: Web Codecs' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[Leo Tenenbaum]

Attachment: Bug 1995659 - Fix handling of duplicate transfer ArrayBuffers in ImageDecoder r?aosmond

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/77f736a623f1
https://hg.mozilla.org/integration/autoland/rev/39b59ec314a5
Fix handling of duplicate transfer ArrayBuffers in ImageDecoder r=aosmond

Comment 4

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/55620 for changes under testing/web-platform/tests

Comment 5

[Norisz Fay [:noriszfay]]

https://hg.mozilla.org/mozilla-central/rev/39b59ec314a5

Comment 6

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot