Changeset 249090 in webkit

Timestamp:

Aug 24, 2019 2:42:42 PM (5 years ago)

Author:

Simon Fraser

Message:

Page crashes under CGPathAddUnevenCornersRoundedRect
​https://bugs.webkit.org/show_bug.cgi?id=201117

Reviewed by Dean Jackson.
Source/WebCore:

Fix crash on ​https://onehtmlpagechallenge.com/entries/pure-css-still-life-water-lemon.html
We were passing CG radius values where the sum of two radii was greater than the height or
width, caused by rounding when converting from floats to doubles.

Test: fast/borders/renderable-uneven-rounded-rects.html

• platform/graphics/cg/PathCG.cpp:

(WebCore::Path::platformAddPathForRoundedRect):

LayoutTests:

• fast/borders/renderable-uneven-rounded-rects-expected.txt: Added.
• fast/borders/renderable-uneven-rounded-rects.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/borders/renderable-uneven-rounded-rects-expected.txt (added)
• LayoutTests/fast/borders/renderable-uneven-rounded-rects.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/platform/graphics/cg/PathCG.cpp (modified) (2 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2019-08-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Page crashes under CGPathAddUnevenCornersRoundedRect
+        https://bugs.webkit.org/show_bug.cgi?id=201117
+
+        Reviewed by Dean Jackson.
+
+        * fast/borders/renderable-uneven-rounded-rects-expected.txt: Added.
+        * fast/borders/renderable-uneven-rounded-rects.html: Added.
+
 2019-08-24  Devin Rousso  <drousso@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2019-08-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Page crashes under CGPathAddUnevenCornersRoundedRect
+        https://bugs.webkit.org/show_bug.cgi?id=201117
+
+        Reviewed by Dean Jackson.
+        
+        Fix crash on https://onehtmlpagechallenge.com/entries/pure-css-still-life-water-lemon.html
+        We were passing CG radius values where the sum of two radii was greater than the height or
+        width, caused by rounding when converting from floats to doubles.
+
+        Test: fast/borders/renderable-uneven-rounded-rects.html
+
+        * platform/graphics/cg/PathCG.cpp:
+        (WebCore::Path::platformAddPathForRoundedRect):
+
 2019-08-23  Simon Fraser  <simon.fraser@apple.com>
 

trunk/Source/WebCore/platform/graphics/cg/PathCG.cpp

@@ -308 +308 @@
         CGFloat rectWidth = CGRectGetWidth(rectToDraw);
         CGFloat rectHeight = CGRectGetHeight(rectToDraw);
-        if (rectWidth < 2 * radiusWidth)
+        if (2 * radiusWidth > rectWidth)
             radiusWidth = rectWidth / 2 - std::numeric_limits<CGFloat>::epsilon();
-        if (rectHeight < 2 * radiusHeight)
+        if (2 * radiusHeight > rectHeight)
             radiusHeight = rectHeight / 2 - std::numeric_limits<CGFloat>::epsilon();
         CGPathAddRoundedRect(ensurePlatformPath(), nullptr, rectToDraw, radiusWidth, radiusHeight);
@@ -318 +318 @@
 #if (PLATFORM(MAC) && __MAC_OS_X_VERSION_MIN_REQUIRED >= 101400) || (PLATFORM(IOS_FAMILY) && __IPHONE_OS_VERSION_MIN_REQUIRED >= 120000)
     CGRect rectToDraw = rect;
+    
+    enum Corners {
+        BottomLeft,
+        BottomRight,
+        TopRight,
+        TopLeft
+    };
     CGSize corners[4] = { bottomLeftRadius, bottomRightRadius, topRightRadius, topLeftRadius };
+
+    CGFloat rectWidth = CGRectGetWidth(rectToDraw);
+    CGFloat rectHeight = CGRectGetHeight(rectToDraw);
+    
+    // Clamp the radii after conversion to CGFloats.
+    corners[TopRight].width = std::min(corners[TopRight].width, rectWidth - corners[TopLeft].width);
+    corners[BottomRight].width = std::min(corners[BottomRight].width, rectWidth - corners[BottomLeft].width);
+    corners[BottomLeft].height = std::min(corners[BottomLeft].height, rectHeight - corners[TopLeft].height);
+    corners[BottomRight].height = std::min(corners[BottomRight].height, rectHeight - corners[TopRight].height);
+
     CGPathAddUnevenCornersRoundedRect(ensurePlatformPath(), nullptr, rectToDraw, corners);
     return;