Changeset 85926 in webkit

Timestamp:

May 6, 2011 12:33:18 AM (13 years ago)

Author:

cdn@chromium.org

Message:

2011-05-06 Cris Neckar <​cdn@chromium.org>

Reviewed by Dirk Schulze.

Change maxEffectRect to a FloatRect.
​https://bugs.webkit.org/show_bug.cgi?id=59551

• svg/filters/filter-after-transform-crash-expected.txt: Added.
• svg/filters/filter-after-transform-crash.svg: Added.

2011-05-06 Cris Neckar <​cdn@chromium.org>

Reviewed by Dirk Schulze.

Tests for crash when a transform is applied to certain filters.
​https://bugs.webkit.org/show_bug.cgi?id=59551

Test: svg/filters/filter-after-transform-crash.svg

• platform/graphics/filters/FEComposite.cpp: (WebCore::FEComposite::determineAbsolutePaintRect):
• platform/graphics/filters/FEConvolveMatrix.h: (WebCore::FEConvolveMatrix::determineAbsolutePaintRect):
• platform/graphics/filters/FEDisplacementMap.h: (WebCore::FEDisplacementMap::determineAbsolutePaintRect):
• platform/graphics/filters/FEFlood.h: (WebCore::FEFlood::determineAbsolutePaintRect):
• platform/graphics/filters/FELighting.h: (WebCore::FELighting::determineAbsolutePaintRect):
• platform/graphics/filters/FETile.h: (WebCore::FETile::determineAbsolutePaintRect):
• platform/graphics/filters/FETurbulence.h: (WebCore::FETurbulence::determineAbsolutePaintRect):
• platform/graphics/filters/FilterEffect.cpp: (WebCore::isFilterSizeValid): (WebCore::FilterEffect::determineAbsolutePaintRect): (WebCore::FilterEffect::asUnmultipliedImage): (WebCore::FilterEffect::asPremultipliedImage): (WebCore::FilterEffect::copyUnmultipliedImage): (WebCore::FilterEffect::copyPremultipliedImage): (WebCore::FilterEffect::createUnmultipliedImageResult): (WebCore::FilterEffect::createPremultipliedImageResult):
• platform/graphics/filters/FilterEffect.h: (WebCore::FilterEffect::maxEffectRect): (WebCore::FilterEffect::setMaxEffectRect):
• rendering/svg/RenderSVGResourceFilter.cpp:
• rendering/svg/RenderSVGResourceFilterPrimitive.cpp: (WebCore::RenderSVGResourceFilterPrimitive::determineFilterPrimitiveSubregion):

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/svg/filters/filter-after-transform-crash-expected.txt (added)
• LayoutTests/svg/filters/filter-after-transform-crash.svg (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/platform/graphics/filters/FEComposite.cpp (modified) (1 diff)
• Source/WebCore/platform/graphics/filters/FEConvolveMatrix.h (modified) (1 diff)
• Source/WebCore/platform/graphics/filters/FEDisplacementMap.h (modified) (1 diff)
• Source/WebCore/platform/graphics/filters/FEFlood.h (modified) (1 diff)
• Source/WebCore/platform/graphics/filters/FELighting.h (modified) (1 diff)
• Source/WebCore/platform/graphics/filters/FETile.h (modified) (1 diff)
• Source/WebCore/platform/graphics/filters/FETurbulence.h (modified) (1 diff)
• Source/WebCore/platform/graphics/filters/FilterEffect.cpp (modified) (8 diffs)
• Source/WebCore/platform/graphics/filters/FilterEffect.h (modified) (3 diffs)
• Source/WebCore/rendering/svg/RenderSVGResourceFilter.cpp (modified) (2 diffs)
• Source/WebCore/rendering/svg/RenderSVGResourceFilterPrimitive.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2011-05-06  Cris Neckar  <cdn@chromium.org>
+
+        Reviewed by Dirk Schulze.
+
+        Change maxEffectRect to a FloatRect.
+        https://bugs.webkit.org/show_bug.cgi?id=59551
+
+        * svg/filters/filter-after-transform-crash-expected.txt: Added.
+        * svg/filters/filter-after-transform-crash.svg: Added.
+
 2011-05-04  Philippe Normand  <pnormand@igalia.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2011-05-06  Cris Neckar  <cdn@chromium.org>
+
+        Reviewed by Dirk Schulze.
+
+        Tests for crash when a transform is applied to certain filters.
+        https://bugs.webkit.org/show_bug.cgi?id=59551
+
+        Test: svg/filters/filter-after-transform-crash.svg
+
+        * platform/graphics/filters/FEComposite.cpp:
+        (WebCore::FEComposite::determineAbsolutePaintRect):
+        * platform/graphics/filters/FEConvolveMatrix.h:
+        (WebCore::FEConvolveMatrix::determineAbsolutePaintRect):
+        * platform/graphics/filters/FEDisplacementMap.h:
+        (WebCore::FEDisplacementMap::determineAbsolutePaintRect):
+        * platform/graphics/filters/FEFlood.h:
+        (WebCore::FEFlood::determineAbsolutePaintRect):
+        * platform/graphics/filters/FELighting.h:
+        (WebCore::FELighting::determineAbsolutePaintRect):
+        * platform/graphics/filters/FETile.h:
+        (WebCore::FETile::determineAbsolutePaintRect):
+        * platform/graphics/filters/FETurbulence.h:
+        (WebCore::FETurbulence::determineAbsolutePaintRect):
+        * platform/graphics/filters/FilterEffect.cpp:
+        (WebCore::isFilterSizeValid):
+        (WebCore::FilterEffect::determineAbsolutePaintRect):
+        (WebCore::FilterEffect::asUnmultipliedImage):
+        (WebCore::FilterEffect::asPremultipliedImage):
+        (WebCore::FilterEffect::copyUnmultipliedImage):
+        (WebCore::FilterEffect::copyPremultipliedImage):
+        (WebCore::FilterEffect::createUnmultipliedImageResult):
+        (WebCore::FilterEffect::createPremultipliedImageResult):
+        * platform/graphics/filters/FilterEffect.h:
+        (WebCore::FilterEffect::maxEffectRect):
+        (WebCore::FilterEffect::setMaxEffectRect):
+        * rendering/svg/RenderSVGResourceFilter.cpp:
+        * rendering/svg/RenderSVGResourceFilterPrimitive.cpp:
+        (WebCore::RenderSVGResourceFilterPrimitive::determineFilterPrimitiveSubregion):
+
 2011-05-06  Luke Macpherson   <macpherson@chromium.org>
 

trunk/Source/WebCore/platform/graphics/filters/FEComposite.cpp

@@ -188 +188 @@
         // Arithmetic may influnce the compele filter primitive region. So we can't
         // optimize the paint region here.
-        setAbsolutePaintRect(maxEffectRect());
+        setAbsolutePaintRect(enclosingIntRect(maxEffectRect()));
         return;
     default:

trunk/Source/WebCore/platform/graphics/filters/FEConvolveMatrix.h

@@ -76 +76 @@
     virtual void dump();
 
-    virtual void determineAbsolutePaintRect() { setAbsolutePaintRect(maxEffectRect()); }
+    virtual void determineAbsolutePaintRect() { setAbsolutePaintRect(enclosingIntRect(maxEffectRect())); }
 
     virtual TextStream& externalRepresentation(TextStream&, int indention) const;

trunk/Source/WebCore/platform/graphics/filters/FEDisplacementMap.h

@@ -54 +54 @@
     virtual void dump();
 
-    virtual void determineAbsolutePaintRect() { setAbsolutePaintRect(maxEffectRect()); }
+    virtual void determineAbsolutePaintRect() { setAbsolutePaintRect(enclosingIntRect(maxEffectRect())); }
 
     virtual TextStream& externalRepresentation(TextStream&, int indention) const;

trunk/Source/WebCore/platform/graphics/filters/FEFlood.h

@@ -43 +43 @@
     virtual void dump();
 
-    virtual void determineAbsolutePaintRect() { setAbsolutePaintRect(maxEffectRect()); }
+    virtual void determineAbsolutePaintRect() { setAbsolutePaintRect(enclosingIntRect(maxEffectRect())); }
 
     virtual TextStream& externalRepresentation(TextStream&, int indention) const;

trunk/Source/WebCore/platform/graphics/filters/FELighting.h

@@ -46 +46 @@
     virtual void apply();
 
-    virtual void determineAbsolutePaintRect() { setAbsolutePaintRect(maxEffectRect()); }
+    virtual void determineAbsolutePaintRect() { setAbsolutePaintRect(enclosingIntRect(maxEffectRect())); }
 
 protected:

trunk/Source/WebCore/platform/graphics/filters/FETile.h

@@ -36 +36 @@
     virtual void dump();
 
-    virtual void determineAbsolutePaintRect() { setAbsolutePaintRect(maxEffectRect()); }
+    virtual void determineAbsolutePaintRect() { setAbsolutePaintRect(enclosingIntRect(maxEffectRect())); }
 
     virtual FilterEffectType filterEffectType() const { return FilterEffectTypeTile; }

trunk/Source/WebCore/platform/graphics/filters/FETurbulence.h

@@ -66 +66 @@
     virtual void dump();
     
-    virtual void determineAbsolutePaintRect() { setAbsolutePaintRect(maxEffectRect()); }
+    virtual void determineAbsolutePaintRect() { setAbsolutePaintRect(enclosingIntRect(maxEffectRect())); }
 
     virtual TextStream& externalRepresentation(TextStream&, int indention) const;

trunk/Source/WebCore/platform/graphics/filters/FilterEffect.cpp

@@ -47 +47 @@
 }
 
+inline bool isFilterSizeValid(IntRect rect)
+{
+    if (rect.width() < 0 || rect.width() > kMaxFilterSize
+        || rect.height() < 0 || rect.height() > kMaxFilterSize)
+        return false;
+    return true;
+}
+
 void FilterEffect::determineAbsolutePaintRect()
 {
@@ -55 +63 @@
     
     // SVG specification wants us to clip to primitive subregion.
-    m_absolutePaintRect.intersect(m_maxEffectRect);
+    m_absolutePaintRect.intersect(enclosingIntRect(m_maxEffectRect));
 }
 
@@ -105 +113 @@
 PassRefPtr<ByteArray> FilterEffect::asUnmultipliedImage(const IntRect& rect)
 {
+    ASSERT(isFilterSizeValid(rect));
     RefPtr<ByteArray> imageData = ByteArray::create(rect.width() * rect.height() * 4);
     copyUnmultipliedImage(imageData.get(), rect);
@@ -112 +121 @@
 PassRefPtr<ByteArray> FilterEffect::asPremultipliedImage(const IntRect& rect)
 {
+    ASSERT(isFilterSizeValid(rect));
     RefPtr<ByteArray> imageData = ByteArray::create(rect.width() * rect.height() * 4);
     copyPremultipliedImage(imageData.get(), rect);
@@ -170 +180 @@
             m_unmultipliedImageResult = m_imageBufferResult->getUnmultipliedImageData(IntRect(IntPoint(), m_absolutePaintRect.size()));
         else {
+            ASSERT(isFilterSizeValid(m_absolutePaintRect));
             m_unmultipliedImageResult = ByteArray::create(m_absolutePaintRect.width() * m_absolutePaintRect.height() * 4);
             unsigned char* sourceComponent = m_premultipliedImageResult->data();
@@ -203 +214 @@
             m_premultipliedImageResult = m_imageBufferResult->getPremultipliedImageData(IntRect(IntPoint(), m_absolutePaintRect.size()));
         else {
+            ASSERT(isFilterSizeValid(m_absolutePaintRect));
             m_premultipliedImageResult = ByteArray::create(m_absolutePaintRect.width() * m_absolutePaintRect.height() * 4);
             unsigned char* sourceComponent = m_unmultipliedImageResult->data();
@@ -239 +251 @@
     // Only one result type is allowed.
     ASSERT(!hasResult());
+    ASSERT(isFilterSizeValid(m_absolutePaintRect));
+
     determineAbsolutePaintRect();
     if (m_absolutePaintRect.isEmpty())
@@ -250 +264 @@
     // Only one result type is allowed.
     ASSERT(!hasResult());
+    ASSERT(isFilterSizeValid(m_absolutePaintRect));
+
     determineAbsolutePaintRect();
     if (m_absolutePaintRect.isEmpty())

trunk/Source/WebCore/platform/graphics/filters/FilterEffect.h

@@ -32 +32 @@
 #include <wtf/RefPtr.h>
 #include <wtf/Vector.h>
+
+static const float kMaxFilterSize = 5000.0f;
 
 namespace WebCore {
@@ -75 +77 @@
     void setAbsolutePaintRect(const IntRect& absolutePaintRect) { m_absolutePaintRect = absolutePaintRect; }
 
-    IntRect maxEffectRect() const { return m_maxEffectRect; }
-    void setMaxEffectRect(const IntRect& maxEffectRect) { m_maxEffectRect = maxEffectRect; } 
+    FloatRect maxEffectRect() const { return m_maxEffectRect; }
+    void setMaxEffectRect(const FloatRect& maxEffectRect) { m_maxEffectRect = maxEffectRect; } 
 
     virtual void apply() = 0;
@@ -129 +131 @@
     // The maximum size of a filter primitive. In SVG this is the primitive subregion in absolute coordinate space.
     // The absolute paint rect should never be bigger than m_maxEffectRect.
-    IntRect m_maxEffectRect;
+    FloatRect m_maxEffectRect;
     Filter* m_filter;
 

trunk/Source/WebCore/rendering/svg/RenderSVGResourceFilter.cpp

@@ -28 +28 @@
 
 #include "AffineTransform.h"
+#include "FilterEffect.h"
 #include "FloatPoint.h"
 #include "FloatRect.h"
@@ -49 +50 @@
 #include <wtf/Vector.h>
 
-static const float kMaxFilterSize = 5000.0f;
-
 using namespace std;
 

trunk/Source/WebCore/rendering/svg/RenderSVGResourceFilterPrimitive.cpp

@@ -129 +129 @@
     absoluteSubregion.intersect(absoluteScaledFilterRegion);
 
-    effect->setMaxEffectRect(enclosingIntRect(absoluteSubregion));
+    effect->setMaxEffectRect(absoluteSubregion);
     return subregion;
 }