summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--third_party/WebKit/LayoutTests/fast/canvas/canvas-createImageBitmap-drawImage.html1
-rw-r--r--third_party/WebKit/LayoutTests/http/tests/security/cross-origin-createImageBitmap-expected.txt18
-rw-r--r--third_party/WebKit/LayoutTests/http/tests/security/cross-origin-createImageBitmap.html90
-rw-r--r--third_party/WebKit/Source/core/frame/ImageBitmap.cpp23
-rw-r--r--third_party/WebKit/Source/core/frame/ImageBitmap.h15
-rw-r--r--third_party/WebKit/Source/core/frame/ImageBitmapTest.cpp30
-rw-r--r--third_party/WebKit/Source/core/html/HTMLCanvasElement.cpp4
-rw-r--r--third_party/WebKit/Source/core/html/HTMLImageElement.cpp11
-rw-r--r--third_party/WebKit/Source/core/html/HTMLVideoElement.cpp11
-rw-r--r--third_party/WebKit/Source/core/imagebitmap/ImageBitmapFactories.cpp5
-rw-r--r--third_party/WebKit/Source/platform/graphics/StaticBitmapImage.h3
11 files changed, 88 insertions, 123 deletions
diff --git a/third_party/WebKit/LayoutTests/fast/canvas/canvas-createImageBitmap-drawImage.html b/third_party/WebKit/LayoutTests/fast/canvas/canvas-createImageBitmap-drawImage.html
index cd81dcf..6442e2a 100644
--- a/third_party/WebKit/LayoutTests/fast/canvas/canvas-createImageBitmap-drawImage.html
+++ b/third_party/WebKit/LayoutTests/fast/canvas/canvas-createImageBitmap-drawImage.html
@@ -154,6 +154,7 @@ function loaded() {
if (imageLoaded && imageBitmapLoaded && blobLoaded) {
// check all of these elements
elements = [image, aCanvas, d, testBitmap, blob];
+
// wait for callback to finish before each check to ensure synchronous behavior
nextCheck(0);
}
diff --git a/third_party/WebKit/LayoutTests/http/tests/security/cross-origin-createImageBitmap-expected.txt b/third_party/WebKit/LayoutTests/http/tests/security/cross-origin-createImageBitmap-expected.txt
index d6ab0ee..21bbc26 100644
--- a/third_party/WebKit/LayoutTests/http/tests/security/cross-origin-createImageBitmap-expected.txt
+++ b/third_party/WebKit/LayoutTests/http/tests/security/cross-origin-createImageBitmap-expected.txt
@@ -1,17 +1,15 @@
-The image bitmap factories should not throw exceptions on cross-origin access.
+The image bitmap factories should throw exceptions on cross-origin access.
On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
-PASS Resolved as expected: image
-PASS ImageBitmap is tainted. Threw error: SecurityError: Failed to execute 'getImageData' on 'CanvasRenderingContext2D': The canvas has been tainted by cross-origin data.
-PASS Resolved as expected: canvas
-PASS ImageBitmap is tainted. Threw error: SecurityError: Failed to execute 'getImageData' on 'CanvasRenderingContext2D': The canvas has been tainted by cross-origin data.
-PASS Resolved as expected: imageBitmap
-PASS ImageBitmap is tainted. Threw error: SecurityError: Failed to execute 'getImageData' on 'CanvasRenderingContext2D': The canvas has been tainted by cross-origin data.
-PASS Resolved as expected: video
-PASS ImageBitmap is tainted. Threw error: SecurityError: Failed to execute 'getImageData' on 'CanvasRenderingContext2D': The canvas has been tainted by cross-origin data.
+PASS Rejected as expected: image
+PASS reason instanceof Error is true
+SecurityError: Failed to execute 'createImageBitmap' on 'Window': Cross-origin access to the source image is denied.
+PASS Rejected as expected: video
+PASS reason instanceof Error is true
+SecurityError: Failed to execute 'createImageBitmap' on 'Window': Cross-origin access to the source video is denied.
PASS successfullyParsed is true
TEST COMPLETE
-
+
diff --git a/third_party/WebKit/LayoutTests/http/tests/security/cross-origin-createImageBitmap.html b/third_party/WebKit/LayoutTests/http/tests/security/cross-origin-createImageBitmap.html
index 3ddf857..b5b5624 100644
--- a/third_party/WebKit/LayoutTests/http/tests/security/cross-origin-createImageBitmap.html
+++ b/third_party/WebKit/LayoutTests/http/tests/security/cross-origin-createImageBitmap.html
@@ -3,80 +3,44 @@
<body>
<script src="/js-test-resources/js-test.js"></script>
<script>
-description("The image bitmap factories should not throw exceptions on cross-origin access.");
+description("The image bitmap factories should throw exceptions on cross-origin access.");
window.jsTestIsAsync = true;
var reason;
-function shouldBeAcceptedAndTainted(promise, message) {
- return promise.then(function(imageBitmap) {
- testPassed('Resolved as expected: ' + message);
- shouldBeTainted(imageBitmap);
+function shouldBeRejected(promise, message) {
+ return promise.then(function() {
+ testFailed('Resolved unexpectedly: ' + message);
}, function(e) {
reason = e;
- testFailed('Rejected unexpectedly: ' + message);
+ testPassed('Rejected as expected: ' + message);
shouldBeTrue('reason instanceof Error');
debug(e);
});
}
-function shouldBeTainted(imageBitmap) {
- var canvas = document.createElement("canvas");
- canvas.width = 10;
- canvas.height = 10;
- var context = canvas.getContext("2d");
- context.drawImage(imageBitmap, 0, 0, 10, 10);
- try {
- var imageData = context.getImageData(0, 0, 10, 10);
- testFailed("ImageBitmap is not tainted.");
- } catch (e) {
- testPassed("ImageBitmap is tainted. Threw error: " + e);
- }
-}
-
-var image = document.createElement('img');
-image.src = 'http://localhost:8080/security/resources/abe.png';
-var video = document.createElement('video');
-video.src = 'http://localhost:8080/media/resources/load-video.php?name=test.ogv&amp;type=video/ogv';
-
-image.addEventListener('load', function() {
- document.body.appendChild(image);
- shouldBeAcceptedAndTainted(createImageBitmap(image, 0, 0, 10, 10), 'image')
-.then(function() {
- var canvas = document.createElement("canvas");
- canvas.width = 10;
- canvas.height = 10;
- var context = canvas.getContext("2d");
- // taint the canvas
- context.drawImage(image, 0, 0, 10, 10);
- shouldBeAcceptedAndTainted(createImageBitmap(canvas, 0, 0, 10, 10), 'canvas')
-.then(function() {
- createImageBitmap(image).then(imageBitmap => {
- shouldBeAcceptedAndTainted(createImageBitmap(imageBitmap, 0, 0, 10, 10), 'imageBitmap')
-.then(function() {
- document.body.appendChild(video);
- video.play();
- video.addEventListener('playing', function() {
- shouldBeAcceptedAndTainted(createImageBitmap(video, 0, 0, 10, 10), 'video')
-.then(finishJSTest, ()=> {
- testFailed("Unexpected failure");
- finishJSTest();
-});
-});
-}, ()=> {
- testFailed("Unexpected failure");
- finishJSTest();
-});
-});
-}, ()=> {
- testFailed("Unexpected failure");
- finishJSTest();
-});
-}, ()=> {
- testFailed("Unexpected failure");
- finishJSTest();
-});
-});
+Promise.resolve().then(function() {
+ return new Promise(function(resolve, reject) {
+ var image = document.createElement('img');
+ image.addEventListener('load', resolve.bind(undefined, image));
+ image.src = 'http://localhost:8080/security/resources/abe.png';
+ document.body.appendChild(image);
+ }).then(function(image) {
+ return shouldBeRejected(createImageBitmap(image, 0, 0, 10, 10), 'image');
+ });
+}).then(function() {
+ return new Promise(function(resolve, reject) {
+ var video = document.createElement('video');
+ video.src = 'http://localhost:8080/media/resources/load-video.php?name=test.ogv&amp;type=video/ogv';
+ video.addEventListener('playing', resolve.bind(undefined, video));
+ document.body.appendChild(video);
+ video.play();
+ }).then(function(video) {
+ return shouldBeRejected(createImageBitmap(video, 0, 0, 10, 10), 'video');
+ });
+}).catch(function(e) {
+ testFailed('Unexpected rejection: ' + e);
+}).then(finishJSTest, finishJSTest);
</script>
</body>
</html>
diff --git a/third_party/WebKit/Source/core/frame/ImageBitmap.cpp b/third_party/WebKit/Source/core/frame/ImageBitmap.cpp
index 4c30836..2d42f46 100644
--- a/third_party/WebKit/Source/core/frame/ImageBitmap.cpp
+++ b/third_party/WebKit/Source/core/frame/ImageBitmap.cpp
@@ -45,13 +45,12 @@ static PassRefPtr<StaticBitmapImage> cropImage(Image* image, const IntRect& crop
return StaticBitmapImage::create(adoptRef(surface->newImageSnapshot()));
}
-ImageBitmap::ImageBitmap(HTMLImageElement* image, const IntRect& cropRect, Document* document)
+ImageBitmap::ImageBitmap(HTMLImageElement* image, const IntRect& cropRect)
{
m_image = cropImage(image->cachedImage()->image(), cropRect);
- m_image->setOriginClean(!image->wouldTaintOrigin(document->securityOrigin()));
}
-ImageBitmap::ImageBitmap(HTMLVideoElement* video, const IntRect& cropRect, Document* document)
+ImageBitmap::ImageBitmap(HTMLVideoElement* video, const IntRect& cropRect)
{
IntSize playerSize;
if (video->webMediaPlayer())
@@ -66,14 +65,12 @@ ImageBitmap::ImageBitmap(HTMLVideoElement* video, const IntRect& cropRect, Docum
IntPoint dstPoint = IntPoint(std::max(0, -cropRect.x()), std::max(0, -cropRect.y()));
video->paintCurrentFrame(buffer->canvas(), IntRect(dstPoint, srcRect.size()), nullptr);
m_image = StaticBitmapImage::create(buffer->newSkImageSnapshot(PreferNoAcceleration));
- m_image->setOriginClean(!video->wouldTaintOrigin(document->securityOrigin()));
}
ImageBitmap::ImageBitmap(HTMLCanvasElement* canvas, const IntRect& cropRect)
{
ASSERT(canvas->isPaintable());
m_image = cropImage(canvas->copiedImage(BackBuffer, PreferAcceleration).get(), cropRect);
- m_image->setOriginClean(canvas->originClean());
}
ImageBitmap::ImageBitmap(ImageData* data, const IntRect& cropRect)
@@ -101,13 +98,11 @@ ImageBitmap::ImageBitmap(ImageData* data, const IntRect& cropRect)
ImageBitmap::ImageBitmap(ImageBitmap* bitmap, const IntRect& cropRect)
{
m_image = cropImage(bitmap->bitmapImage(), cropRect);
- m_image->setOriginClean(bitmap->originClean());
}
-ImageBitmap::ImageBitmap(PassRefPtrWillBeRawPtr<StaticBitmapImage> image, const IntRect& cropRect)
+ImageBitmap::ImageBitmap(Image* image, const IntRect& cropRect)
{
- m_image = cropImage(image.get(), cropRect);
- m_image->setOriginClean(image->originClean());
+ m_image = cropImage(image, cropRect);
}
ImageBitmap::ImageBitmap(PassRefPtr<StaticBitmapImage> image)
@@ -126,16 +121,16 @@ ImageBitmap::~ImageBitmap()
{
}
-PassRefPtrWillBeRawPtr<ImageBitmap> ImageBitmap::create(HTMLImageElement* image, const IntRect& cropRect, Document* document)
+PassRefPtrWillBeRawPtr<ImageBitmap> ImageBitmap::create(HTMLImageElement* image, const IntRect& cropRect)
{
IntRect normalizedCropRect = normalizeRect(cropRect);
- return adoptRefWillBeNoop(new ImageBitmap(image, normalizedCropRect, document));
+ return adoptRefWillBeNoop(new ImageBitmap(image, normalizedCropRect));
}
-PassRefPtrWillBeRawPtr<ImageBitmap> ImageBitmap::create(HTMLVideoElement* video, const IntRect& cropRect, Document* document)
+PassRefPtrWillBeRawPtr<ImageBitmap> ImageBitmap::create(HTMLVideoElement* video, const IntRect& cropRect)
{
IntRect normalizedCropRect = normalizeRect(cropRect);
- return adoptRefWillBeNoop(new ImageBitmap(video, normalizedCropRect, document));
+ return adoptRefWillBeNoop(new ImageBitmap(video, normalizedCropRect));
}
PassRefPtrWillBeRawPtr<ImageBitmap> ImageBitmap::create(HTMLCanvasElement* canvas, const IntRect& cropRect)
@@ -156,7 +151,7 @@ PassRefPtrWillBeRawPtr<ImageBitmap> ImageBitmap::create(ImageBitmap* bitmap, con
return adoptRefWillBeNoop(new ImageBitmap(bitmap, normalizedCropRect));
}
-PassRefPtrWillBeRawPtr<ImageBitmap> ImageBitmap::create(PassRefPtr<StaticBitmapImage> image, const IntRect& cropRect)
+PassRefPtrWillBeRawPtr<ImageBitmap> ImageBitmap::create(Image* image, const IntRect& cropRect)
{
IntRect normalizedCropRect = normalizeRect(cropRect);
return adoptRefWillBeNoop(new ImageBitmap(image, normalizedCropRect));
diff --git a/third_party/WebKit/Source/core/frame/ImageBitmap.h b/third_party/WebKit/Source/core/frame/ImageBitmap.h
index 6af36c0..59fbf33 100644
--- a/third_party/WebKit/Source/core/frame/ImageBitmap.h
+++ b/third_party/WebKit/Source/core/frame/ImageBitmap.h
@@ -28,13 +28,13 @@ class CORE_EXPORT ImageBitmap final : public RefCountedWillBeGarbageCollectedFin
DEFINE_WRAPPERTYPEINFO();
WILL_BE_USING_GARBAGE_COLLECTED_MIXIN(ImageBitmap);
public:
- static PassRefPtrWillBeRawPtr<ImageBitmap> create(HTMLImageElement*, const IntRect&, Document*);
- static PassRefPtrWillBeRawPtr<ImageBitmap> create(HTMLVideoElement*, const IntRect&, Document*);
+ static PassRefPtrWillBeRawPtr<ImageBitmap> create(HTMLImageElement*, const IntRect&);
+ static PassRefPtrWillBeRawPtr<ImageBitmap> create(HTMLVideoElement*, const IntRect&);
static PassRefPtrWillBeRawPtr<ImageBitmap> create(HTMLCanvasElement*, const IntRect&);
static PassRefPtrWillBeRawPtr<ImageBitmap> create(ImageData*, const IntRect&);
static PassRefPtrWillBeRawPtr<ImageBitmap> create(ImageBitmap*, const IntRect&);
+ static PassRefPtrWillBeRawPtr<ImageBitmap> create(Image*, const IntRect&);
static PassRefPtrWillBeRawPtr<ImageBitmap> create(PassRefPtr<StaticBitmapImage>);
- static PassRefPtrWillBeRawPtr<ImageBitmap> create(PassRefPtr<StaticBitmapImage>, const IntRect&);
StaticBitmapImage* bitmapImage() const { return (m_image) ? m_image.get() : nullptr; }
unsigned long width() const;
@@ -42,14 +42,13 @@ public:
IntSize size() const;
bool isNeutered() const { return m_isNeutered; }
- bool originClean() const { return m_image->originClean(); }
PassRefPtr<StaticBitmapImage> transfer();
~ImageBitmap() override;
// CanvasImageSource implementation
PassRefPtr<Image> getSourceImageForCanvas(SourceImageStatus*, AccelerationHint) const override;
- bool wouldTaintOrigin(SecurityOrigin*) const override { return !m_image->originClean(); }
+ bool wouldTaintOrigin(SecurityOrigin*) const override { return false; }
void adjustDrawRects(FloatRect* srcRect, FloatRect* dstRect) const override;
FloatSize elementSize() const override;
@@ -60,13 +59,13 @@ public:
DECLARE_VIRTUAL_TRACE();
private:
- ImageBitmap(HTMLImageElement*, const IntRect&, Document*);
- ImageBitmap(HTMLVideoElement*, const IntRect&, Document*);
+ ImageBitmap(HTMLImageElement*, const IntRect&);
+ ImageBitmap(HTMLVideoElement*, const IntRect&);
ImageBitmap(HTMLCanvasElement*, const IntRect&);
ImageBitmap(ImageData*, const IntRect&);
ImageBitmap(ImageBitmap*, const IntRect&);
+ ImageBitmap(Image*, const IntRect&);
ImageBitmap(PassRefPtr<StaticBitmapImage>);
- ImageBitmap(PassRefPtr<StaticBitmapImage>, const IntRect&);
// ImageLoaderClient
void notifyImageSourceChanged() override;
diff --git a/third_party/WebKit/Source/core/frame/ImageBitmapTest.cpp b/third_party/WebKit/Source/core/frame/ImageBitmapTest.cpp
index f22d259..54f9870 100644
--- a/third_party/WebKit/Source/core/frame/ImageBitmapTest.cpp
+++ b/third_party/WebKit/Source/core/frame/ImageBitmapTest.cpp
@@ -85,17 +85,13 @@ TEST_F(ImageBitmapTest, ImageResourceConsistency)
imageElement->setImageResource(new ImageResource(StaticBitmapImage::create(m_image).get()));
RefPtrWillBeRawPtr<ImageBitmap> imageBitmapNoCrop = ImageBitmap::create(imageElement.get(),
- IntRect(0, 0, m_image->width(), m_image->height()),
- &(imageElement->document()));
+ IntRect(0, 0, m_image->width(), m_image->height()));
RefPtrWillBeRawPtr<ImageBitmap> imageBitmapInteriorCrop = ImageBitmap::create(imageElement.get(),
- IntRect(m_image->width() / 2, m_image->height() / 2, m_image->width() / 2, m_image->height() / 2),
- &(imageElement->document()));
+ IntRect(m_image->width() / 2, m_image->height() / 2, m_image->width() / 2, m_image->height() / 2));
RefPtrWillBeRawPtr<ImageBitmap> imageBitmapExteriorCrop = ImageBitmap::create(imageElement.get(),
- IntRect(-m_image->width() / 2, -m_image->height() / 2, m_image->width(), m_image->height()),
- &(imageElement->document()));
+ IntRect(-m_image->width() / 2, -m_image->height() / 2, m_image->width(), m_image->height()));
RefPtrWillBeRawPtr<ImageBitmap> imageBitmapOutsideCrop = ImageBitmap::create(imageElement.get(),
- IntRect(-m_image->width(), -m_image->height(), m_image->width(), m_image->height()),
- &(imageElement->document()));
+ IntRect(-m_image->width(), -m_image->height(), m_image->width(), m_image->height()));
ASSERT_EQ(imageBitmapNoCrop->bitmapImage()->imageForCurrentFrame(), imageElement->cachedImage()->image()->imageForCurrentFrame());
ASSERT_NE(imageBitmapInteriorCrop->bitmapImage()->imageForCurrentFrame(), imageElement->cachedImage()->image()->imageForCurrentFrame());
@@ -150,21 +146,16 @@ TEST_F(ImageBitmapTest, ImageBitmapLiveResourcePriority)
ASSERT_EQ(memoryCache()->priority(imageOutsideCrop->cachedImage()), MemoryCacheLiveResourcePriorityLow);
RefPtrWillBePersistent<ImageBitmap> imageBitmapInteriorCrop = ImageBitmap::create(imageInteriorCrop.get(),
- IntRect(m_image->width() / 2, m_image->height() / 2, m_image->width(), m_image->height()),
- &(imageInteriorCrop->document()));
+ IntRect(m_image->width() / 2, m_image->height() / 2, m_image->width(), m_image->height()));
{
RefPtrWillBePersistent<ImageBitmap> imageBitmapNoCrop = ImageBitmap::create(imageNoCrop.get(),
- IntRect(0, 0, m_image->width(), m_image->height()),
- &(imageNoCrop->document()));
+ IntRect(0, 0, m_image->width(), m_image->height()));
RefPtrWillBePersistent<ImageBitmap> imageBitmapInteriorCrop2 = ImageBitmap::create(imageInteriorCrop.get(),
- IntRect(m_image->width() / 2, m_image->height() / 2, m_image->width(), m_image->height()),
- &(imageInteriorCrop->document()));
+ IntRect(m_image->width() / 2, m_image->height() / 2, m_image->width(), m_image->height()));
RefPtrWillBePersistent<ImageBitmap> imageBitmapExteriorCrop = ImageBitmap::create(imageExteriorCrop.get(),
- IntRect(-m_image->width() / 2, -m_image->height() / 2, m_image->width(), m_image->height()),
- &(imageExteriorCrop->document()));
+ IntRect(-m_image->width() / 2, -m_image->height() / 2, m_image->width(), m_image->height()));
RefPtrWillBePersistent<ImageBitmap> imageBitmapOutsideCrop = ImageBitmap::create(imageOutsideCrop.get(),
- IntRect(-m_image->width(), -m_image->height(), m_image->width(), m_image->height()),
- &(imageOutsideCrop->document()));
+ IntRect(-m_image->width(), -m_image->height(), m_image->width(), m_image->height()));
// Images are not referenced by ImageBitmap anymore, so always CacheLiveResourcePriorityLow
ASSERT_EQ(memoryCache()->priority(imageNoCrop->cachedImage()), MemoryCacheLiveResourcePriorityLow);
@@ -196,8 +187,7 @@ TEST_F(ImageBitmapTest, ImageBitmapSourceChanged)
image->setImageResource(originalImageResource.get());
RefPtrWillBeRawPtr<ImageBitmap> imageBitmap = ImageBitmap::create(image.get(),
- IntRect(0, 0, m_image->width(), m_image->height()),
- &(image->document()));
+ IntRect(0, 0, m_image->width(), m_image->height()));
ASSERT_EQ(imageBitmap->bitmapImage()->imageForCurrentFrame(), originalImageResource->image()->imageForCurrentFrame());
ResourcePtr<ImageResource> newImageResource = new ImageResource(
diff --git a/third_party/WebKit/Source/core/html/HTMLCanvasElement.cpp b/third_party/WebKit/Source/core/html/HTMLCanvasElement.cpp
index 07a62ea..11eb39f 100644
--- a/third_party/WebKit/Source/core/html/HTMLCanvasElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLCanvasElement.cpp
@@ -1003,6 +1003,10 @@ IntSize HTMLCanvasElement::bitmapSourceSize() const
ScriptPromise HTMLCanvasElement::createImageBitmap(ScriptState* scriptState, EventTarget& eventTarget, int sx, int sy, int sw, int sh, ExceptionState& exceptionState)
{
ASSERT(eventTarget.toDOMWindow());
+ if (!originClean()) {
+ exceptionState.throwSecurityError("The canvas element provided is tainted with cross-origin data.");
+ return ScriptPromise();
+ }
if (!sw || !sh) {
exceptionState.throwDOMException(IndexSizeError, String::format("The source %s provided is 0.", sw ? "height" : "width"));
return ScriptPromise();
diff --git a/third_party/WebKit/Source/core/html/HTMLImageElement.cpp b/third_party/WebKit/Source/core/html/HTMLImageElement.cpp
index 6568ae8..f1fed96 100644
--- a/third_party/WebKit/Source/core/html/HTMLImageElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLImageElement.cpp
@@ -699,7 +699,16 @@ ScriptPromise HTMLImageElement::createImageBitmap(ScriptState* scriptState, Even
exceptionState.throwDOMException(IndexSizeError, String::format("The source %s provided is 0.", sw ? "height" : "width"));
return ScriptPromise();
}
- return ImageBitmapSource::fulfillImageBitmap(scriptState, ImageBitmap::create(this, IntRect(sx, sy, sw, sh), eventTarget.toDOMWindow()->document()));
+ if (!cachedImage()->image()->currentFrameHasSingleSecurityOrigin()) {
+ exceptionState.throwSecurityError("The source image contains image data from multiple origins.");
+ return ScriptPromise();
+ }
+ Document* document = eventTarget.toDOMWindow()->document();
+ if (!cachedImage()->passesAccessControlCheck(document->securityOrigin()) && document->securityOrigin()->taintsCanvas(src())) {
+ exceptionState.throwSecurityError("Cross-origin access to the source image is denied.");
+ return ScriptPromise();
+ }
+ return ImageBitmapSource::fulfillImageBitmap(scriptState, ImageBitmap::create(this, IntRect(sx, sy, sw, sh)));
}
void HTMLImageElement::selectSourceURL(ImageLoader::UpdateFromElementBehavior behavior)
diff --git a/third_party/WebKit/Source/core/html/HTMLVideoElement.cpp b/third_party/WebKit/Source/core/html/HTMLVideoElement.cpp
index 38bda79..6847cd1 100644
--- a/third_party/WebKit/Source/core/html/HTMLVideoElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLVideoElement.cpp
@@ -340,7 +340,16 @@ ScriptPromise HTMLVideoElement::createImageBitmap(ScriptState* scriptState, Even
exceptionState.throwDOMException(IndexSizeError, String::format("The source %s provided is 0.", sw ? "height" : "width"));
return ScriptPromise();
}
- return ImageBitmapSource::fulfillImageBitmap(scriptState, ImageBitmap::create(this, IntRect(sx, sy, sw, sh), eventTarget.toDOMWindow()->document()));
+ if (!hasSingleSecurityOrigin()) {
+ exceptionState.throwSecurityError("The source video contains image data from multiple origins.");
+ return ScriptPromise();
+ }
+ if (!webMediaPlayer()->didPassCORSAccessCheck()
+ && eventTarget.toDOMWindow()->document()->securityOrigin()->taintsCanvas(currentSrc())) {
+ exceptionState.throwSecurityError("Cross-origin access to the source video is denied.");
+ return ScriptPromise();
+ }
+ return ImageBitmapSource::fulfillImageBitmap(scriptState, ImageBitmap::create(this, IntRect(sx, sy, sw, sh)));
}
} // namespace blink
diff --git a/third_party/WebKit/Source/core/imagebitmap/ImageBitmapFactories.cpp b/third_party/WebKit/Source/core/imagebitmap/ImageBitmapFactories.cpp
index c9226d9..11a21fd 100644
--- a/third_party/WebKit/Source/core/imagebitmap/ImageBitmapFactories.cpp
+++ b/third_party/WebKit/Source/core/imagebitmap/ImageBitmapFactories.cpp
@@ -183,14 +183,13 @@ void ImageBitmapFactories::ImageBitmapLoader::didFinishLoading()
return;
}
- RefPtr<StaticBitmapImage> image = StaticBitmapImage::create(frame);
- image->setOriginClean(true);
+ RefPtr<Image> image = StaticBitmapImage::create(frame);
if (!m_cropRect.width() && !m_cropRect.height()) {
// No cropping variant was called.
m_cropRect = IntRect(IntPoint(), image->size());
}
- RefPtrWillBeRawPtr<ImageBitmap> imageBitmap = ImageBitmap::create(image, m_cropRect);
+ RefPtrWillBeRawPtr<ImageBitmap> imageBitmap = ImageBitmap::create(image.get(), m_cropRect);
m_resolver->resolve(imageBitmap.release());
m_factory->didFinishLoading(this);
}
diff --git a/third_party/WebKit/Source/platform/graphics/StaticBitmapImage.h b/third_party/WebKit/Source/platform/graphics/StaticBitmapImage.h
index bd36802..b2e84d9 100644
--- a/third_party/WebKit/Source/platform/graphics/StaticBitmapImage.h
+++ b/third_party/WebKit/Source/platform/graphics/StaticBitmapImage.h
@@ -23,13 +23,10 @@ public:
PassRefPtr<SkImage> imageForCurrentFrame() override;
- bool originClean() const { return m_isOriginClean; }
- void setOriginClean(bool flag) { m_isOriginClean = flag; }
protected:
StaticBitmapImage(PassRefPtr<SkImage>);
RefPtr<SkImage> m_image;
- bool m_isOriginClean = true;
};
} // namespace blink