summaryrefslogtreecommitdiffstats
path: root/dom/canvas/WebGLTextureUpload.cpp
diff options
context:
space:
mode:
Diffstat (limited to 'dom/canvas/WebGLTextureUpload.cpp')
-rw-r--r--dom/canvas/WebGLTextureUpload.cpp18
1 files changed, 16 insertions, 2 deletions
diff --git a/dom/canvas/WebGLTextureUpload.cpp b/dom/canvas/WebGLTextureUpload.cpp
index ef29d18..7170fc1 100644
--- a/dom/canvas/WebGLTextureUpload.cpp
+++ b/dom/canvas/WebGLTextureUpload.cpp
@@ -12,6 +12,7 @@
#include "GLBlitHelper.h"
#include "GLContext.h"
#include "mozilla/gfx/2D.h"
+#include "mozilla/dom/HTMLCanvasElement.h"
#include "mozilla/dom/HTMLVideoElement.h"
#include "mozilla/dom/ImageBitmap.h"
#include "mozilla/dom/ImageData.h"
@@ -222,7 +223,12 @@ static UniquePtr<webgl::TexUnpackBytes> FromPboOffset(
static UniquePtr<webgl::TexUnpackBlob> FromImageBitmap(
WebGLContext* webgl, const char* funcName, TexImageTarget target,
uint32_t width, uint32_t height, uint32_t depth,
- const dom::ImageBitmap& imageBitmap) {
+ const dom::ImageBitmap& imageBitmap, ErrorResult* aRv) {
+ if (imageBitmap.IsWriteOnly()) {
+ aRv->Throw(NS_ERROR_DOM_SECURITY_ERR);
+ return nullptr;
+ }
+
UniquePtr<dom::ImageBitmapCloneData> cloneData =
Move(imageBitmap.ToCloneData());
const RefPtr<gfx::DataSourceSurface> surf = cloneData->mSurface;
@@ -294,6 +300,14 @@ UniquePtr<webgl::TexUnpackBlob> WebGLContext::FromDomElem(
const char* funcName, TexImageTarget target, uint32_t width,
uint32_t height, uint32_t depth, const dom::Element& elem,
ErrorResult* const out_error) {
+ if (elem.IsHTMLElement(nsGkAtoms::canvas)) {
+ const dom::HTMLCanvasElement* canvas = static_cast<const dom::HTMLCanvasElement*>(&elem);
+ if (canvas->IsWriteOnly()) {
+ out_error->Throw(NS_ERROR_DOM_SECURITY_ERR);
+ return nullptr;
+ }
+ }
+
// The canvas spec says that drawImage should draw the first frame of
// animated images. The webgl spec doesn't mention the issue, so we do the
// same as drawImage.
@@ -414,7 +428,7 @@ UniquePtr<webgl::TexUnpackBlob> WebGLContext::From(
if (src.mImageBitmap) {
return FromImageBitmap(this, funcName, target, width, height, depth,
- *(src.mImageBitmap));
+ *(src.mImageBitmap), src.mOut_error);
}
if (src.mImageData) {