Changeset 218648 in webkit

Timestamp:

Jun 21, 2017, 2:13:58 PM (8 years ago)

Author:

Simon Fraser

Message:

svgPath.getTotalLength() freezes webkit
​https://bugs.webkit.org/show_bug.cgi?id=173566
<rdar://problem/32866731>

Reviewed by Dean Jackson.

Source/WebCore:

Ensure that curveLength() progresses by making split() return a bool indicating
whether either of the resulting curves are the same as the original. This can happen
when midPoint() on two close points returns a point that is the same as one of the
arguments because of floating-point precision limitations.

Test: svg/custom/path-getTotalLength-hang.html

• platform/graphics/PathTraversalState.cpp:

(WebCore::QuadraticBezier::operator ==):
(WebCore::QuadraticBezier::split):
(WebCore::CubicBezier::operator ==):
(WebCore::CubicBezier::split):
(WebCore::curveLength):

LayoutTests:

• svg/custom/path-getTotalLength-hang.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/svg/custom/path-getTotalLength-hang-expected.txt (added)
• LayoutTests/svg/custom/path-getTotalLength-hang.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/platform/graphics/PathTraversalState.cpp (modified) (7 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2017-06-21  Simon Fraser  <simon.fraser@apple.com>
+
+        svgPath.getTotalLength() freezes webkit
+        https://bugs.webkit.org/show_bug.cgi?id=173566
+        <rdar://problem/32866731>
+
+        Reviewed by Dean Jackson.
+
+        * svg/custom/path-getTotalLength-hang.html: Added.
+
 2017-06-21  Claudio Saavedra  <csaavedra@igalia.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2017-06-20  Simon Fraser  <simon.fraser@apple.com>
+
+        svgPath.getTotalLength() freezes webkit
+        https://bugs.webkit.org/show_bug.cgi?id=173566
+        <rdar://problem/32866731>
+
+        Reviewed by Dean Jackson.
+
+        Ensure that curveLength() progresses by making split() return a bool indicating
+        whether either of the resulting curves are the same as the original. This can happen
+        when midPoint() on two close points returns a point that is the same as one of the
+        arguments because of floating-point precision limitations.
+
+        Test: svg/custom/path-getTotalLength-hang.html
+
+        * platform/graphics/PathTraversalState.cpp:
+        (WebCore::QuadraticBezier::operator ==):
+        (WebCore::QuadraticBezier::split):
+        (WebCore::CubicBezier::operator ==):
+        (WebCore::CubicBezier::split):
+        (WebCore::curveLength):
+
 2017-06-21  Youenn Fablet  <youenn@apple.com>
 

trunk/Source/WebCore/platform/graphics/PathTraversalState.cpp

@@ -49 +49 @@
     {
     }
+
+    bool operator==(const QuadraticBezier& rhs) const
+    {
+        return start == rhs.start
+            && control == rhs.control
+            && end == rhs.end;
+    }
     
     float approximateDistance() const
@@ -55 +62 @@
     }
     
-    void split(QuadraticBezier& left, QuadraticBezier& right) const
+    bool split(QuadraticBezier& left, QuadraticBezier& right) const
     {
         left.control = midPoint(start, control);
@@ -66 +73 @@
         left.start = start;
         right.end = end;
+
+        return !(left == *this) && !(right == *this);
     }
     
@@ -82 +91 @@
     {
     }
-    
+
+    bool operator==(const CubicBezier& rhs) const
+    {
+        return start == rhs.start
+            && control1 == rhs.control1
+            && control2 == rhs.control2
+            && end == rhs.end;
+    }
+
     float approximateDistance() const
     {
@@ -88 +105 @@
     }
         
-    void split(CubicBezier& left, CubicBezier& right) const
+    bool split(CubicBezier& left, CubicBezier& right) const
     {    
         FloatPoint startToControl1 = midPoint(control1, control2);
@@ -103 +120 @@
         left.end = leftControl2ToRightControl1;
         right.start = leftControl2ToRightControl1;
+
+        return !(left == *this) && !(right == *this);
     }
     
@@ -128 +147 @@
         float length = curve.approximateDistance();
 
-        if ((length - distanceLine(curve.start, curve.end)) > kPathSegmentLengthTolerance && curveStack.size() < curveStackDepthLimit) {
-            CurveType leftCurve;
-            CurveType rightCurve;
-            curve.split(leftCurve, rightCurve);
+        CurveType leftCurve;
+        CurveType rightCurve;
+
+        if ((length - distanceLine(curve.start, curve.end)) > kPathSegmentLengthTolerance && curveStack.size() < curveStackDepthLimit && curve.split(leftCurve, rightCurve)) {
             curve = leftCurve;
             curveStack.append(rightCurve);