Log Message
Source/WebCore: Crash when using megaplan.ru https://bugs.webkit.org/show_bug.cgi?id=163276 rdar://problem/28446672
Reviewed by Sam Weinig. Make sure we allocate enough space in the vector of CGPoints that we use for path building. Test: css3/masking/large-clip-path.html * platform/graphics/cg/PathCG.cpp: (WebCore::Path::polygonPathFromPoints): LayoutTests: polygonPathFromPoints calls uncheckedAppend, but assertion size() < capacity() fails https://bugs.webkit.org/show_bug.cgi?id=163276 Reviewed by Sam Weinig. * css3/masking/large-clip-path-expected.txt: Added. * css3/masking/large-clip-path.html: Added.
Modified Paths
- trunk/LayoutTests/ChangeLog
- trunk/Source/WebCore/ChangeLog
- trunk/Source/WebCore/platform/graphics/cg/PathCG.cpp
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (207273 => 207274)
--- trunk/LayoutTests/ChangeLog 2016-10-13 02:38:13 UTC (rev 207273)
+++ trunk/LayoutTests/ChangeLog 2016-10-13 03:16:15 UTC (rev 207274)
@@ -1,3 +1,13 @@
+2016-10-12 Simon Fraser <simon.fra...@apple.com>
+
+ polygonPathFromPoints calls uncheckedAppend, but assertion size() < capacity() fails
+ https://bugs.webkit.org/show_bug.cgi?id=163276
+
+ Reviewed by Sam Weinig.
+
+ * css3/masking/large-clip-path-expected.txt: Added.
+ * css3/masking/large-clip-path.html: Added.
+
2016-10-12 Joseph Pecoraro <pecor...@apple.com>
Web Inspector: step-into `console.log(o)` should not step through inspector _javascript_
Added: trunk/LayoutTests/css3/masking/large-clip-path-expected.txt (0 => 207274)
--- trunk/LayoutTests/css3/masking/large-clip-path-expected.txt (rev 0)
+++ trunk/LayoutTests/css3/masking/large-clip-path-expected.txt 2016-10-13 03:16:15 UTC (rev 207274)
@@ -0,0 +1,3 @@
+Test passes if there is no ASSERT in debug.
+
+
Added: trunk/LayoutTests/css3/masking/large-clip-path.html (0 => 207274)
--- trunk/LayoutTests/css3/masking/large-clip-path.html (rev 0)
+++ trunk/LayoutTests/css3/masking/large-clip-path.html 2016-10-13 03:16:15 UTC (rev 207274)
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+
+<html>
+<head>
+ <style>
+ .box {
+ height: 100px;
+ width: 100px;
+ background-color: silver;
+ -webkit-clip-path: polygon(26px 52px,21.938px 51.959px,18.314px 51.821px,15.105px 51.561px,12.286px 51.157px,9.832px 50.583px,7.72px 49.814px,5.925px 48.827px,4.422px 47.598px,3.187px 46.103px,2.196px 44.317px,1.424px 42.216px,.847px 39.777px,.441px 36.974px,.181px 33.785px,.043px 30.184px,0 26.148px,.039px 22.182px,.173px 18.626px,.426px 15.459px,.824px 12.66px,1.392px 10.207px,2.155px 8.08px,3.137px 6.257px,4.365px 4.716px,5.863px 3.437px,7.655px 2.397px,9.767px 1.575px,12.224px .951px,15.051px .503px,18.273px .209px,21.915px .048px,26px 0,29.939px .057px,33.472px .24px,36.619px .567px,39.4px 1.056px,41.838px 1.725px,43.953px 2.592px,45.765px 3.676px,47.298px 4.994px,48.571px 6.565px,49.607px 8.406px,50.425px 10.536px,51.047px 12.973px,51.494px 15.734px,51.787px 18.838px,51.947px 22.303px,52px 26.148px,51.971px 30.087px,51.865px 33.615px,51.651px 36.754px,51.302px 39.526px,50.788px 41.953px,50.08px 44.056px,49.15px 45.856px,47.969px 47.376px,46.508px 48.636px,4
4.737px 49.657px,42.629px 50.464px,40.152px 51.074px,37.28px 51.512px,33.983px 51.798px,30.233px 51.954px,26px 52px,26px 52px,26px 52px,26px 52px,26px 52px,26px 52px,26px 52px,26px 52px,26px 52px,26px 52px,26px 52px,26px 52px,26px 52px,26px 52px,26px 52px,26px 52px,26px 52px);
+ }
+ </style>
+ <script>
+ if (window.testRunner)
+ testRunner.dumpAsText();
+ </script>
+</head>
+<body>
+<p>Test passes if there is no ASSERT in debug.</p>
+<div class="box"></div>
+</body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (207273 => 207274)
--- trunk/Source/WebCore/ChangeLog 2016-10-13 02:38:13 UTC (rev 207273)
+++ trunk/Source/WebCore/ChangeLog 2016-10-13 03:16:15 UTC (rev 207274)
@@ -1,3 +1,18 @@
+2016-10-12 Simon Fraser <simon.fra...@apple.com>
+
+ Crash when using megaplan.ru
+ https://bugs.webkit.org/show_bug.cgi?id=163276
+ rdar://problem/28446672
+
+ Reviewed by Sam Weinig.
+
+ Make sure we allocate enough space in the vector of CGPoints that we use for path building.
+
+ Test: css3/masking/large-clip-path.html
+
+ * platform/graphics/cg/PathCG.cpp:
+ (WebCore::Path::polygonPathFromPoints):
+
2016-10-12 Alex Christensen <achristen...@webkit.org>
Fix out-of-bounds reading in URLParser when parsing improperly percent-encoded values
Modified: trunk/Source/WebCore/platform/graphics/cg/PathCG.cpp (207273 => 207274)
--- trunk/Source/WebCore/platform/graphics/cg/PathCG.cpp 2016-10-13 02:38:13 UTC (rev 207273)
+++ trunk/Source/WebCore/platform/graphics/cg/PathCG.cpp 2016-10-13 03:16:15 UTC (rev 207274)
@@ -80,7 +80,7 @@
return path;
Vector<CGPoint, 32> cgPoints;
- cgPoints.reserveInitialCapacity(points.size() - 1);
+ cgPoints.reserveInitialCapacity(points.size());
for (size_t i = 0; i < points.size(); ++i)
cgPoints.uncheckedAppend(points[i]);
_______________________________________________ webkit-changes mailing list webkit-changes@lists.webkit.org https://lists.webkit.org/mailman/listinfo/webkit-changes
