icecat: update to upstream version 128.0.14-1gnu1

icecat/dom/html/HTMLCanvasElement.cpp

@@ -15,6 +15,7 @@
 #include "mozilla/BasePrincipal.h"
 #include "mozilla/CheckedInt.h"
 #include "mozilla/PresShell.h"
+#include "mozilla/dom/BlobImpl.h"
 #include "mozilla/dom/CanvasCaptureMediaStream.h"
 #include "mozilla/dom/CanvasRenderingContext2D.h"
 #include "mozilla/dom/Document.h"
@@ -768,16 +769,26 @@ void HTMLCanvasElement::ToDataURL(JSContext* aCx, const nsAString& aType,
                                   nsAString& aDataURL,
                                   nsIPrincipal& aSubjectPrincipal,
                                   ErrorResult& aRv) {
-  // mWriteOnly check is redundant, but optimizes for the common case.
-  if (mWriteOnly && !CallerCanRead(aSubjectPrincipal)) {
+  bool recheckCanRead = mOffscreenDisplay && mOffscreenDisplay->HasWorkerRef();
+
+  if (!CallerCanRead(aSubjectPrincipal)) {
     aRv.Throw(NS_ERROR_DOM_SECURITY_ERR);
     return;
   }
 
-  nsresult rv = ToDataURLImpl(aCx, aSubjectPrincipal, aType, aParams, aDataURL);
-  if (NS_FAILED(rv)) {
-    aDataURL.AssignLiteral("data:,");
+  nsString dataURL;
+  nsresult rv = ToDataURLImpl(aCx, aSubjectPrincipal, aType, aParams, dataURL);
+  if (recheckCanRead && !CallerCanRead(aSubjectPrincipal)) {
+    aRv.Throw(NS_ERROR_DOM_SECURITY_ERR);
+    return;
   }
+
+  if (NS_FAILED(rv)) {
+    aDataURL.Assign(u"data:,"_ns);
+    return;
+  }
+
+  aDataURL = std::move(dataURL);
 }
 
 void HTMLCanvasElement::SetMozPrintCallback(PrintCallback* aCallback) {
@@ -993,8 +1004,9 @@ void HTMLCanvasElement::ToBlob(JSContext* aCx, BlobCallback& aCallback,
                                JS::Handle<JS::Value> aParams,
                                nsIPrincipal& aSubjectPrincipal,
                                ErrorResult& aRv) {
-  // mWriteOnly check is redundant, but optimizes for the common case.
-  if (mWriteOnly && !CallerCanRead(aSubjectPrincipal)) {
+  bool recheckCanRead = mOffscreenDisplay && mOffscreenDisplay->HasWorkerRef();
+
+  if (!CallerCanRead(aSubjectPrincipal)) {
     aRv.Throw(NS_ERROR_DOM_SECURITY_ERR);
     return;
   }
@@ -1019,7 +1031,59 @@ void HTMLCanvasElement::ToBlob(JSContext* aCx, BlobCallback& aCallback,
   // If no permission, return all-white, opaque image data.
   bool usePlaceholder = !CanvasUtils::IsImageExtractionAllowed(
       OwnerDoc(), aCx, aSubjectPrincipal);
-  CanvasRenderingContextHelper::ToBlob(aCx, global, aCallback, aType, aParams,
+
+  // Encoder callback when encoding is complete.
+  class EncodeCallback : public EncodeCompleteCallback {
+   public:
+    EncodeCallback(nsIGlobalObject* aGlobal, BlobCallback* aCallback,
+                   OffscreenCanvasDisplayHelper* aOffscreenDisplay,
+                   nsIPrincipal* aSubjectPrincipal)
+        : mGlobal(aGlobal),
+          mBlobCallback(aCallback),
+          mOffscreenDisplay(aOffscreenDisplay),
+          mSubjectPrincipal(aSubjectPrincipal) {}
+
+    // This is called on main thread.
+    MOZ_CAN_RUN_SCRIPT
+    nsresult ReceiveBlobImpl(already_AddRefed<BlobImpl> aBlobImpl) override {
+      MOZ_ASSERT(NS_IsMainThread());
+
+      RefPtr<BlobImpl> blobImpl = aBlobImpl;
+
+      RefPtr<Blob> blob;
+
+      if (blobImpl && (!mOffscreenDisplay ||
+                       mOffscreenDisplay->CallerCanRead(*mSubjectPrincipal))) {
+        blob = Blob::Create(mGlobal, blobImpl);
+      }
+
+      RefPtr<BlobCallback> callback(std::move(mBlobCallback));
+      ErrorResult rv;
+
+      callback->Call(blob, rv);
+
+      mGlobal = nullptr;
+      MOZ_ASSERT(!mBlobCallback);
+
+      return rv.StealNSResult();
+    }
+
+    bool CanBeDeletedOnAnyThread() override {
+      // EncodeCallback is used from the main thread only.
+      return false;
+    }
+
+    nsCOMPtr<nsIGlobalObject> mGlobal;
+    RefPtr<BlobCallback> mBlobCallback;
+    RefPtr<OffscreenCanvasDisplayHelper> mOffscreenDisplay;
+    RefPtr<nsIPrincipal> mSubjectPrincipal;
+  };
+
+  RefPtr<EncodeCompleteCallback> callback = new EncodeCallback(
+      global, &aCallback, recheckCanRead ? mOffscreenDisplay.get() : nullptr,
+      recheckCanRead ? &aSubjectPrincipal : nullptr);
+
+  CanvasRenderingContextHelper::ToBlob(aCx, callback, aType, aParams,
                                        usePlaceholder, aRv);
 }
 
@@ -1090,7 +1154,12 @@ already_AddRefed<nsISupports> HTMLCanvasElement::GetContext(
 
 nsIntSize HTMLCanvasElement::GetSize() { return GetWidthHeight(); }
 
-bool HTMLCanvasElement::IsWriteOnly() const { return mWriteOnly; }
+bool HTMLCanvasElement::IsWriteOnly() const {
+  if (mOffscreenDisplay && mOffscreenDisplay->IsWriteOnly()) {
+    return true;
+  }
+  return mWriteOnly;
+}
 
 void HTMLCanvasElement::SetWriteOnly(
     nsIPrincipal* aExpandedReader /* = nullptr */) {
@@ -1102,6 +1171,10 @@ void HTMLCanvasElement::SetWriteOnly(
 }
 
 bool HTMLCanvasElement::CallerCanRead(nsIPrincipal& aPrincipal) const {
+  if (mOffscreenDisplay && !mOffscreenDisplay->CallerCanRead(aPrincipal)) {
+    return false;
+  }
+
   if (!mWriteOnly) {
     return true;
   }