Changeset 264645 in webkit

Timestamp:

Jul 21, 2020, 1:03:28 AM (6 years ago)

Author:

Carlos Garcia Campos

Message:

[GTK][WPE] imported blink large gradient tests are crashing on debug builds
​https://bugs.webkit.org/show_bug.cgi?id=214192

Reviewed by Žan Doberšek.

The assert is:

ASSERT(cairo_surface_status(m_surface.get()) == CAIRO_STATUS_SUCCESS);

and the status we are getting is CAIRO_STATUS_INVALID_SIZE, because we are reaching the cairo image size
limit. We should check the size before trying to create the image surface. This patch fixes the crash, but not
the tests themselves that will still fail due to the cairo limitation.

• platform/graphics/cairo/ImageBufferCairoImageSurfaceBackend.cpp:

(WebCore::ImageBufferCairoImageSurfaceBackend::create): Return early if the image size is bigger than the
maximum allowed by cairo.

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• platform/graphics/cairo/ImageBufferCairoImageSurfaceBackend.cpp (modified) (2 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2020-07-21  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK][WPE] imported blink large gradient tests are crashing on debug builds
+        https://bugs.webkit.org/show_bug.cgi?id=214192
+
+        Reviewed by Žan Doberšek.
+
+        The assert is:
+            ASSERT(cairo_surface_status(m_surface.get()) == CAIRO_STATUS_SUCCESS);
+
+        and the status we are getting is CAIRO_STATUS_INVALID_SIZE, because we are reaching the cairo image size
+        limit. We should check the size before trying to create the image surface. This patch fixes the crash, but not
+        the tests themselves that will still fail due to the cairo limitation.
+
+        * platform/graphics/cairo/ImageBufferCairoImageSurfaceBackend.cpp:
+        (WebCore::ImageBufferCairoImageSurfaceBackend::create): Return early if the image size is bigger than the
+        maximum allowed by cairo.
+
 2020-07-20  Alex Christensen  <achristensen@webkit.org>
 

trunk/Source/WebCore/platform/graphics/cairo/ImageBufferCairoImageSurfaceBackend.cpp

@@ -34 +34 @@
 
 #include "Color.h"
+#include "ImageBackingStore.h"
 #include <cairo.h>
 #include <wtf/IsoMallocInlines.h>
@@ -46 +47 @@
 
     IntSize backendSize = calculateBackendSize(size, resolutionScale);
-    if (backendSize.isEmpty())
+    if (backendSize.isEmpty() || backendSize.width() > cairoMaxImageSize || backendSize.height() > cairoMaxImageSize)
         return nullptr;