1 files changed, 35 insertions, 7 deletions

diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext2D.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext2D.cpp
index 8add19cc94..9cec7a92b1 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext2D.cpp
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext2D.cpp
@@ -209,7 +209,7 @@ float CanvasRenderingContext2D::lineWidth() const
 
 void CanvasRenderingContext2D::setLineWidth(float width)
 {
-    if (!(width > 0))
+    if (!(isfinite(width) && width > 0))
         return;
     state().m_lineWidth = width;
     GraphicsContext* c = drawingContext();
@@ -259,7 +259,7 @@ float CanvasRenderingContext2D::miterLimit() const
 
 void CanvasRenderingContext2D::setMiterLimit(float limit)
 {
-    if (!(limit > 0))
+    if (!(isfinite(limit) && limit > 0))
         return;
     state().m_miterLimit = limit;
     GraphicsContext* c = drawingContext();
@@ -275,6 +275,8 @@ float CanvasRenderingContext2D::shadowOffsetX() const
 
 void CanvasRenderingContext2D::setShadowOffsetX(float x)
 {
+    if (!isfinite(x))
+        return;
     state().m_shadowOffset.setWidth(x);
     applyShadow();
 }
@@ -286,6 +288,8 @@ float CanvasRenderingContext2D::shadowOffsetY() const
 
 void CanvasRenderingContext2D::setShadowOffsetY(float y)
 {
+    if (!isfinite(y))
+        return;
     state().m_shadowOffset.setHeight(y);
     applyShadow();
 }
@@ -297,6 +301,8 @@ float CanvasRenderingContext2D::shadowBlur() const
 
 void CanvasRenderingContext2D::setShadowBlur(float blur)
 {
+    if (!(isfinite(blur) && blur >= 0))
+        return;
     state().m_shadowBlur = blur;
     applyShadow();
 }
@@ -867,8 +873,6 @@ void CanvasRenderingContext2D::setShadow(float width, float height, float blur,
         return;
 
     RGBA32 rgba = makeRGBA32FromFloats(r, g, b, a); // default is transparent black
-    if (!state().m_shadowColor.isEmpty())
-        CSSParser::parseColor(rgba, state().m_shadowColor);
     c->setShadow(IntSize(width, -height), state().m_shadowBlur, Color(rgba), DeviceColorSpace);
 }
 
@@ -1274,14 +1278,30 @@ static PassRefPtr<ImageData> createEmptyImageData(const IntSize& size)
     return data.get();
 }
 
+PassRefPtr<ImageData> CanvasRenderingContext2D::createImageData(PassRefPtr<ImageData> imageData, ExceptionCode& ec) const
+{
+    if (!imageData) {
+        ec = NOT_SUPPORTED_ERR;
+        return 0;
+    }
+
+    IntSize size(imageData->width(), imageData->height());
+    return createEmptyImageData(size);
+}
+
 PassRefPtr<ImageData> CanvasRenderingContext2D::createImageData(float sw, float sh, ExceptionCode& ec) const
 {
     ec = 0;
+    if (!sw || !sh) {
+        ec = INDEX_SIZE_ERR;
+        return 0;
+    }
     if (!isfinite(sw) || !isfinite(sh)) {
         ec = NOT_SUPPORTED_ERR;
         return 0;
     }
-    FloatSize unscaledSize(sw, sh);
+
+    FloatSize unscaledSize(fabs(sw), fabs(sh));
     IntSize scaledSize = canvas()->convertLogicalToDevice(unscaledSize);
     if (scaledSize.width() < 1)
         scaledSize.setWidth(1);
@@ -1297,7 +1317,15 @@ PassRefPtr<ImageData> CanvasRenderingContext2D::getImageData(float sx, float sy,
         ec = SECURITY_ERR;
         return 0;
     }
-    
+    if (!sw || !sh) {
+        ec = INDEX_SIZE_ERR;
+        return 0;
+    }
+    if (!isfinite(sx) || !isfinite(sy) || !isfinite(sw) || !isfinite(sh)) {
+        ec = NOT_SUPPORTED_ERR;
+        return 0;
+    }
+
     FloatRect unscaledRect(sx, sy, sw, sh);
     IntRect scaledRect = canvas()->convertLogicalToDevice(unscaledRect);
     if (scaledRect.width() < 1)
@@ -1328,7 +1356,7 @@ void CanvasRenderingContext2D::putImageData(ImageData* data, float dx, float dy,
     }
     if (!isfinite(dx) || !isfinite(dy) || !isfinite(dirtyX) || 
         !isfinite(dirtyY) || !isfinite(dirtyWidth) || !isfinite(dirtyHeight)) {
-        ec = INDEX_SIZE_ERR;
+        ec = NOT_SUPPORTED_ERR;
         return;
     }