Copied from: https://hg.mozilla.org/releases/mozilla-esr38/rev/93617c30c0df Security advisory: https://www.mozilla.org/en-US/security/advisories/mfsa2016-01/ Mozilla Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1230686 # HG changeset patch # User Lee Salzman # Date 1451932822 18000 # Node ID 93617c30c0df35f719dead526b78649d564f5ac3 # Parent 4f6e81673f6938719c86516606f2fda493e8c23c Bug 1230686 - use RefPtr& instead of DrawTarget* to track changes in SurfaceFromElement a=ritu diff --git a/layout/base/nsLayoutUtils.cpp b/layout/base/nsLayoutUtils.cpp --- a/layout/base/nsLayoutUtils.cpp +++ b/layout/base/nsLayoutUtils.cpp @@ -6494,17 +6494,17 @@ nsLayoutUtils::IsReallyFixedPos(nsIFrame nsIAtom *parentType = aFrame->GetParent()->GetType(); return parentType == nsGkAtoms::viewportFrame || parentType == nsGkAtoms::pageContentFrame; } nsLayoutUtils::SurfaceFromElementResult nsLayoutUtils::SurfaceFromElement(nsIImageLoadingContent* aElement, uint32_t aSurfaceFlags, - DrawTarget* aTarget) + RefPtr& aTarget) { SurfaceFromElementResult result; nsresult rv; nsCOMPtr imgRequest; rv = aElement->GetRequest(nsIImageLoadingContent::CURRENT_REQUEST, getter_AddRefs(imgRequest)); if (NS_FAILED(rv) || !imgRequest) @@ -6586,41 +6586,41 @@ nsLayoutUtils::SurfaceFromElement(nsIIma result.mImageRequest = imgRequest.forget(); return result; } nsLayoutUtils::SurfaceFromElementResult nsLayoutUtils::SurfaceFromElement(HTMLImageElement *aElement, uint32_t aSurfaceFlags, - DrawTarget* aTarget) + RefPtr& aTarget) { return SurfaceFromElement(static_cast(aElement), aSurfaceFlags, aTarget); } nsLayoutUtils::SurfaceFromElementResult nsLayoutUtils::SurfaceFromElement(HTMLCanvasElement* aElement, uint32_t aSurfaceFlags, - DrawTarget* aTarget) + RefPtr& aTarget) { SurfaceFromElementResult result; bool* isPremultiplied = nullptr; if (aSurfaceFlags & SFE_PREFER_NO_PREMULTIPLY_ALPHA) { isPremultiplied = &result.mIsPremultiplied; } gfxIntSize size = aElement->GetSize(); result.mSourceSurface = aElement->GetSurfaceSnapshot(isPremultiplied); if (!result.mSourceSurface) { // If the element doesn't have a context then we won't get a snapshot. The canvas spec wants us to not error and just // draw nothing, so return an empty surface. - DrawTarget *ref = aTarget ? aTarget : gfxPlatform::GetPlatform()->ScreenReferenceDrawTarget(); + DrawTarget *ref = aTarget ? aTarget.get() : gfxPlatform::GetPlatform()->ScreenReferenceDrawTarget(); RefPtr dt = ref->CreateSimilarDrawTarget(IntSize(size.width, size.height), SurfaceFormat::B8G8R8A8); if (dt) { result.mSourceSurface = dt->Snapshot(); } } else if (aTarget) { RefPtr opt = aTarget->OptimizeSourceSurface(result.mSourceSurface); if (opt) { @@ -6637,17 +6637,17 @@ nsLayoutUtils::SurfaceFromElement(HTMLCa result.mIsWriteOnly = aElement->IsWriteOnly(); return result; } nsLayoutUtils::SurfaceFromElementResult nsLayoutUtils::SurfaceFromElement(HTMLVideoElement* aElement, uint32_t aSurfaceFlags, - DrawTarget* aTarget) + RefPtr& aTarget) { SurfaceFromElementResult result; NS_WARN_IF_FALSE((aSurfaceFlags & SFE_PREFER_NO_PREMULTIPLY_ALPHA) == 0, "We can't support non-premultiplied alpha for video!"); #ifdef MOZ_EME if (aElement->ContainsRestrictedContent()) { return result; @@ -6689,17 +6689,17 @@ nsLayoutUtils::SurfaceFromElement(HTMLVi result.mIsWriteOnly = false; return result; } nsLayoutUtils::SurfaceFromElementResult nsLayoutUtils::SurfaceFromElement(dom::Element* aElement, uint32_t aSurfaceFlags, - DrawTarget* aTarget) + RefPtr& aTarget) { // If it's a , we may be able to just grab its internal surface if (HTMLCanvasElement* canvas = HTMLCanvasElement::FromContentOrNull(aElement)) { return SurfaceFromElement(canvas, aSurfaceFlags, aTarget); } // Maybe it's