← WebKit — 2026-W36
a8a0b96619f38d1a9cb165fd57e25c27cee2ef7b Return transparent black for a placeholder canvas that has no pushed frame
severity low
class LogicError
confidence 0.35
signal score 9.37
Source/WebCore/html
Primitive: PlaceholderRenderingContext::surfaceBufferToImageBuffer returned a null m_buffer to callers expecting a valid ImageBuffer
Triage note: When m_buffer is null the method now returns canvas().createTransparentBlackImageBuffer() instead of nullptr. Prevents a possible null-ImageBuffer being handed to callers (potential crash), but no demonstrated attacker-controlled memory-corruption primitive.
Triage note: When m_buffer is null the method now returns canvas().createTransparentBlackImageBuffer() instead of nullptr. Prevents a possible null-ImageBuffer being handed to callers (potential crash), but no demonstrated attacker-controlled memory-corruption primitive.
Structural signals: smartptr_member_added (+4.87), null_guard (+1.2), area:Source/WebCore/html (+2.0), surgical (+1.3)
Commit message
Return transparent black for a placeholder canvas that has no pushed frame
https://bugs.webkit.org/show_bug.cgi?id=322961
rdar://186229685
Reviewed by Said Abou-Hallawa.
CanvasBase::makeRenderingResultsAvailable fabricates a transparent black bitmap
only when a canvas has no rendering context. A placeholder canvas has an internal
PlaceholderRenderingContext, so it took the context path instead, and that
returned nullptr until the OffscreenCanvas pushed its first frame. ImageBitmap
turned the null into "Cannot create ImageBitmap from canvas that can't be
rendered", which rejected the promise and timed out two subtests.
HTML's usability check makes an HTMLCanvasElement source bad only when a
dimension is zero, so a sized placeholder with no pushed frame is good and must
produce a transparent black bitmap. PlaceholderRenderingContext already reports
isSurfaceBufferTransparentBlack() when it has no buffer, so the class modelled
this correctly for painting and simply did not apply it when asked for a buffer.
createPattern, toDataURL, toBlob and toVideoFrame reach the same path.
* LayoutTests/TestExpectations:
* Source/WebCore/html/CanvasBase.cpp:
(WebCore::CanvasBase::makeRenderingResultsAvailable):
(WebCore::CanvasBase::createTransparentBlackImageBuffer const):
* Source/WebCore/html/CanvasBase.h:
* Source/WebCore/html/canvas/PlaceholderRenderingContext.cpp:
(WebCore::PlaceholderRenderingContext::surfaceBufferToImageBuffer):
Canonical link: https://commits.webkit.org/320202@main
Before / after
Loading diff…
On This Page