Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Setting CanvasRenderingContext2D.filter when the canvas has no layout node crashes with null deref #3661

Open
Lubrsi opened this issue Feb 21, 2025 · 1 comment
Open

Setting CanvasRenderingContext2D.filter when the canvas has no layout node crashes with null deref #3661

Lubrsi opened this issue Feb 21, 2025 · 1 comment
Labels
bug Something isn't working reduction of web content Issue has a simplified reduction based on real-world web content. web compatibility

Comments

@Lubrsi
Copy link
Contributor

Lubrsi commented Feb 21, 2025 •
edited
Loading

Example:

<!DOCTYPE html>
<html lang="en">
<body>
<script>
    const canvas = document.createElement("canvas");
    const ctx = canvas.getContext("2d");
    ctx.filter = "blur(1px)";
</script>
</body>
</html>

Found on https://jigsawpuzzles.io/

This is caused by this code having an incorrect assumption that update_layout will make layout nodes non-null. However, this is not the case for elements not in the DOM yet, or has display: none; set.

ladybird/Libraries/LibWeb/HTML/CanvasRenderingContext2D.cpp

Lines 959 to 961 in a4ee3fb

// Note: The layout must be updated to make sure the canvas's layout node isn't null.
canvas_element().document().update_layout();
auto layout_node = canvas_element().layout_node();

This doesn't seem like it can be fixed by returning if the layout node is null, because it's possible that filter is only set/used whilst the canvas has no layout node. For example, a fingerprinting script could do this, where it never appends the canvas to the DOM.
@Lubrsi Lubrsi added bug Something isn't working reduction of web content Issue has a simplified reduction based on real-world web content. web compatibility labels Feb 21, 2025
@shannonbooth
Copy link
Contributor

shannonbooth commented Mar 2, 2025 •
edited
Loading

I believe this WPT test covers this case https://wpt.live/html/canvas/element/layers/2d.layer.opaque-canvas.ctx-filter.html

I was previously trying to figure out with https://discord.com/channels/1247070541085671459/1247090082297548832/1328553049119002776

About why we need a layout node at all. I was/am wondering whether using a resolution context for window would be appropriate fix for the filter or if it would cause wrong rwaults in some cases

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Something isn't working reduction of web content Issue has a simplified reduction based on real-world web content. web compatibility
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@Lubrsi @shannonbooth