Skip to content

Commit 3697146

Browse files
graveljpChromium LUCI CQ
authored and
Chromium LUCI CQ
committed
Reject kernelMatrix with 0 width in convolveMatrix CanvasFilters.
Only the height was checked (rejecting `[]` kernels) but kernels with zero width like `[[], []]` were incorrectly accepted. The current CanvasFilter specification is defined by reusing the SVG specification for how the filters attributes work (whatwg/html#6763). For the "feConvolveMatrix" filter, the SVG specification says (https://www.w3.org/TR/SVG11/filters.html#feConvolveMatrixElement): "Attribute definitions: - order = "<number-optional-number>" Indicates the number of cells in each dimension for ‘kernelMatrix’. The values provided must be <integer>s greater than zero. The first number, <orderX>, indicates the number of columns in the matrix. The second number, <orderY>, indicates the number of rows in the matrix. If <orderY> is not provided, it defaults to <orderX>." Change-Id: I23baf05db73e679a52cd9d553d7c6308d91b56f9 Bug: 1428652 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4377066 Reviewed-by: Aaron Krajeski <[email protected]> Commit-Queue: Jean-Philippe Gravel <[email protected]> Cr-Commit-Position: refs/heads/main@{#1124423}
1 parent 2c8ac61 commit 3697146

File tree

5 files changed

+26
-1
lines changed

5 files changed

+26
-1
lines changed

third_party/blink/renderer/modules/canvas/canvas2d/canvas_filter_operation_resolver.cc

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,8 @@ absl::optional<KernelMatrix> GetKernelMatrix(const Dictionary& dict,
6565
absl::optional<Vector<Vector<float>>> km_input =
6666
dict.Get<IDLSequence<IDLSequence<IDLFloat>>>("kernelMatrix",
6767
exception_state);
68-
if (!km_input.has_value() || km_input->size() == 0) {
68+
if (!km_input.has_value() || km_input->size() == 0 ||
69+
(km_input->size() >= 2 && km_input->at(0).size() == 0)) {
6970
exception_state.ThrowTypeError(
7071
"Failed to construct convolve matrix filter. 'kernelMatrix' must be an "
7172
"array of arrays of numbers representing an n by m matrix.");

third_party/blink/web_tests/external/wpt/html/canvas/element/filters/2d.filter.canvasFilterObject.convolveMatrix.exceptions.tentative.html

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,8 +28,14 @@ <h1>2d.filter.canvasFilterObject.convolveMatrix.exceptions.tentative</h1>
2828
assert_throws_js(TypeError, function() { new CanvasFilter({filter: "convolveMatrix", kernelMatrix: [[1, 0], 0]}); });
2929
assert_throws_js(TypeError, function() { new CanvasFilter({filter: "convolveMatrix", kernelMatrix: [[1, 0], [0, Infinity]]}); });
3030
assert_throws_js(TypeError, function() { new CanvasFilter({filter: "convolveMatrix", kernelMatrix: []}); });
31+
assert_throws_js(TypeError, function() { new CanvasFilter({filter: "convolveMatrix", kernelMatrix: [1]}); });
32+
assert_throws_js(TypeError, function() { new CanvasFilter({filter: "convolveMatrix", kernelMatrix: [1, 2, 3, 4]}); });
33+
assert_throws_js(TypeError, function() { new CanvasFilter({filter: "convolveMatrix", kernelMatrix: [[], []]}); });
34+
assert_throws_js(TypeError, function() { new CanvasFilter({filter: "convolveMatrix", kernelMatrix: [[1, 2], []]}); });
35+
assert_throws_js(TypeError, function() { new CanvasFilter({filter: "convolveMatrix", kernelMatrix: [[], [1, 2]]}); });
3136
// This should not throw an error
3237
ctx.filter = new CanvasFilter({filter: "convolveMatrix", kernelMatrix: [[]]});
38+
ctx.filter = new CanvasFilter({filter: "convolveMatrix", kernelMatrix: [[1]]});
3339

3440

3541
});

third_party/blink/web_tests/external/wpt/html/canvas/offscreen/filters/2d.filter.canvasFilterObject.convolveMatrix.exceptions.tentative.html

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,8 +30,14 @@ <h1>2d.filter.canvasFilterObject.convolveMatrix.exceptions.tentative</h1>
3030
assert_throws_js(TypeError, function() { new CanvasFilter({filter: "convolveMatrix", kernelMatrix: [[1, 0], 0]}); });
3131
assert_throws_js(TypeError, function() { new CanvasFilter({filter: "convolveMatrix", kernelMatrix: [[1, 0], [0, Infinity]]}); });
3232
assert_throws_js(TypeError, function() { new CanvasFilter({filter: "convolveMatrix", kernelMatrix: []}); });
33+
assert_throws_js(TypeError, function() { new CanvasFilter({filter: "convolveMatrix", kernelMatrix: [1]}); });
34+
assert_throws_js(TypeError, function() { new CanvasFilter({filter: "convolveMatrix", kernelMatrix: [1, 2, 3, 4]}); });
35+
assert_throws_js(TypeError, function() { new CanvasFilter({filter: "convolveMatrix", kernelMatrix: [[], []]}); });
36+
assert_throws_js(TypeError, function() { new CanvasFilter({filter: "convolveMatrix", kernelMatrix: [[1, 2], []]}); });
37+
assert_throws_js(TypeError, function() { new CanvasFilter({filter: "convolveMatrix", kernelMatrix: [[], [1, 2]]}); });
3338
// This should not throw an error
3439
ctx.filter = new CanvasFilter({filter: "convolveMatrix", kernelMatrix: [[]]});
40+
ctx.filter = new CanvasFilter({filter: "convolveMatrix", kernelMatrix: [[1]]});
3541
})(canvas, ctx);
3642
t.done();
3743

third_party/blink/web_tests/external/wpt/html/canvas/offscreen/filters/2d.filter.canvasFilterObject.convolveMatrix.exceptions.tentative.worker.js

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,8 +25,14 @@ assert_throws_js(TypeError, function() { new CanvasFilter({filter: "convolveMatr
2525
assert_throws_js(TypeError, function() { new CanvasFilter({filter: "convolveMatrix", kernelMatrix: [[1, 0], 0]}); });
2626
assert_throws_js(TypeError, function() { new CanvasFilter({filter: "convolveMatrix", kernelMatrix: [[1, 0], [0, Infinity]]}); });
2727
assert_throws_js(TypeError, function() { new CanvasFilter({filter: "convolveMatrix", kernelMatrix: []}); });
28+
assert_throws_js(TypeError, function() { new CanvasFilter({filter: "convolveMatrix", kernelMatrix: [1]}); });
29+
assert_throws_js(TypeError, function() { new CanvasFilter({filter: "convolveMatrix", kernelMatrix: [1, 2, 3, 4]}); });
30+
assert_throws_js(TypeError, function() { new CanvasFilter({filter: "convolveMatrix", kernelMatrix: [[], []]}); });
31+
assert_throws_js(TypeError, function() { new CanvasFilter({filter: "convolveMatrix", kernelMatrix: [[1, 2], []]}); });
32+
assert_throws_js(TypeError, function() { new CanvasFilter({filter: "convolveMatrix", kernelMatrix: [[], [1, 2]]}); });
2833
// This should not throw an error
2934
ctx.filter = new CanvasFilter({filter: "convolveMatrix", kernelMatrix: [[]]});
35+
ctx.filter = new CanvasFilter({filter: "convolveMatrix", kernelMatrix: [[1]]});
3036
t.done();
3137

3238
});

third_party/blink/web_tests/external/wpt/html/canvas/tools/yaml-new/filters.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -154,8 +154,14 @@
154154
@assert throws TypeError new CanvasFilter({filter: "convolveMatrix", kernelMatrix: [[1, 0], 0]});
155155
@assert throws TypeError new CanvasFilter({filter: "convolveMatrix", kernelMatrix: [[1, 0], [0, Infinity]]});
156156
@assert throws TypeError new CanvasFilter({filter: "convolveMatrix", kernelMatrix: []});
157+
@assert throws TypeError new CanvasFilter({filter: "convolveMatrix", kernelMatrix: [1]});
158+
@assert throws TypeError new CanvasFilter({filter: "convolveMatrix", kernelMatrix: [1, 2, 3, 4]});
159+
@assert throws TypeError new CanvasFilter({filter: "convolveMatrix", kernelMatrix: [[], []]});
160+
@assert throws TypeError new CanvasFilter({filter: "convolveMatrix", kernelMatrix: [[1, 2], []]});
161+
@assert throws TypeError new CanvasFilter({filter: "convolveMatrix", kernelMatrix: [[], [1, 2]]});
157162
// This should not throw an error
158163
ctx.filter = new CanvasFilter({filter: "convolveMatrix", kernelMatrix: [[]]});
164+
ctx.filter = new CanvasFilter({filter: "convolveMatrix", kernelMatrix: [[1]]});
159165
160166
- name: 2d.filter.canvasFilterObject.componentTransfer.linear.tentative
161167
desc: Test pixels on CanvasFilter() componentTransfer with linear type

0 commit comments

Comments
 (0)