Changeset 248743 in webkit

Timestamp:

Aug 15, 2019 1:49:56 PM (5 years ago)

Author:

Alan Coon

Message:

Cherry-pick r248722. rdar://problem/54360866

Negative size box with border radius causes hang under WebCore::approximateAsRegion
​https://bugs.webkit.org/show_bug.cgi?id=200769
<rdar://problem/53380674>

Reviewed by Alex Christensen.

Source/WebCore:

If a box's width or height computes negative the rounded border rect will also be negative.
This caused near-infinite loop during rounded border region approximation.

Test: fast/css/border-radius-negative-size.html

• platform/graphics/RoundedRect.cpp: (WebCore::approximateAsRegion):

Bail out if the region is empty (which includes negative sizes).
For safety also limit the number of rectangles we generate for corner arc approximation.

LayoutTests:

• fast/css/border-radius-negative-size-expected.txt: Added.
• fast/css/border-radius-negative-size.html: Added.

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@248722 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:

branches/safari-608-branch

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/css/border-radius-negative-size-expected.txt (added)
• LayoutTests/fast/css/border-radius-negative-size.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/platform/graphics/RoundedRect.cpp (modified) (2 diffs)

branches/safari-608-branch/LayoutTests/ChangeLog

@@ +1 @@
+2019-08-15  Alan Coon  <alancoon@apple.com>
+
+        Cherry-pick r248722. rdar://problem/54360866
+
+    Negative size box with border radius causes hang under WebCore::approximateAsRegion
+    https://bugs.webkit.org/show_bug.cgi?id=200769
+    <rdar://problem/53380674>
+    
+    Reviewed by Alex Christensen.
+    
+    Source/WebCore:
+    
+    If a box's width or height computes negative the rounded border rect will also be negative.
+    This caused near-infinite loop during rounded border region approximation.
+    
+    Test: fast/css/border-radius-negative-size.html
+    
+    * platform/graphics/RoundedRect.cpp:
+    (WebCore::approximateAsRegion):
+    
+    Bail out if the region is empty (which includes negative sizes).
+    For safety also limit the number of rectangles we generate for corner arc approximation.
+    
+    LayoutTests:
+    
+    * fast/css/border-radius-negative-size-expected.txt: Added.
+    * fast/css/border-radius-negative-size.html: Added.
+    
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@248722 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2019-08-15  Antti Koivisto  <antti@apple.com>
+
+            Negative size box with border radius causes hang under WebCore::approximateAsRegion
+            https://bugs.webkit.org/show_bug.cgi?id=200769
+            <rdar://problem/53380674>
+
+            Reviewed by Alex Christensen.
+
+            * fast/css/border-radius-negative-size-expected.txt: Added.
+            * fast/css/border-radius-negative-size.html: Added.
+
 2019-08-15  Alan Coon  <alancoon@apple.com>
 

branches/safari-608-branch/Source/WebCore/ChangeLog

@@ +1 @@
+2019-08-15  Alan Coon  <alancoon@apple.com>
+
+        Cherry-pick r248722. rdar://problem/54360866
+
+    Negative size box with border radius causes hang under WebCore::approximateAsRegion
+    https://bugs.webkit.org/show_bug.cgi?id=200769
+    <rdar://problem/53380674>
+    
+    Reviewed by Alex Christensen.
+    
+    Source/WebCore:
+    
+    If a box's width or height computes negative the rounded border rect will also be negative.
+    This caused near-infinite loop during rounded border region approximation.
+    
+    Test: fast/css/border-radius-negative-size.html
+    
+    * platform/graphics/RoundedRect.cpp:
+    (WebCore::approximateAsRegion):
+    
+    Bail out if the region is empty (which includes negative sizes).
+    For safety also limit the number of rectangles we generate for corner arc approximation.
+    
+    LayoutTests:
+    
+    * fast/css/border-radius-negative-size-expected.txt: Added.
+    * fast/css/border-radius-negative-size.html: Added.
+    
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@248722 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2019-08-15  Antti Koivisto  <antti@apple.com>
+
+            Negative size box with border radius causes hang under WebCore::approximateAsRegion
+            https://bugs.webkit.org/show_bug.cgi?id=200769
+            <rdar://problem/53380674>
+
+            Reviewed by Alex Christensen.
+
+            If a box's width or height computes negative the rounded border rect will also be negative.
+            This caused near-infinite loop during rounded border region approximation.
+
+            Test: fast/css/border-radius-negative-size.html
+
+            * platform/graphics/RoundedRect.cpp:
+            (WebCore::approximateAsRegion):
+
+            Bail out if the region is empty (which includes negative sizes).
+            For safety also limit the number of rectangles we generate for corner arc approximation.
+
 2019-08-15  Alan Coon  <alancoon@apple.com>
 

branches/safari-608-branch/Source/WebCore/platform/graphics/RoundedRect.cpp

@@ -311 +311 @@
     Region region;
 
+    if (roundedRect.isEmpty())
+        return region;
+
     auto& rect = roundedRect.rect();
     region.unite(enclosingIntRect(rect));
@@ -333 +336 @@
         auto count = (arcLengthFactor + (stepLength / 2)) / stepLength;
 
+        constexpr auto maximumCount = 20u;
+        count = std::min(maximumCount, count);
+
         for (auto i = 0u; i < count; ++i) {
             auto angle = fromAngle + (i + 1) * (toAngle - fromAngle) / (count + 1);