1309073 - Crashes when calling processOneGlyph() with finalPosition.fX = NaN

Status: RESOLVED WORKSFORME

(Core :: Graphics: Canvas2D, defect)

Description

[Vincent Liu[:vliu]]

The crash happens when running SVG with large tspan value below.


<text x="500" y="320" font-family="Arial,Helvetica">This colourPicker has a callBack function<tspan x="500" dy="170141183460469231731687303715884105727.2em">attached that changes the background color</tspan></text>

Comment 1

[Vincent Liu[:vliu]]

Attachment: crash-svg-test.html

The attached test case can reproduce the issue on my Mac local build.

Comment 2

[Vincent Liu[:vliu]]

Attachment: svg-crash-backtrace.txt

The attached file was the backtrace when crash happens.

Comment 3

[Vincent Liu[:vliu]]

Attachment: Add finalPosition.isFinite() once it hits Infinite or NaN.

Hi Lee,
Could you please have a review? Thanks

Comment 4

[Lee Salzman [:lsalzman]]

Comment on attachment 8799651 [details] [diff] [review]
Add finalPosition.isFinite() once it hits Infinite or NaN.

In principle the fix is okayish, but this was already fixed upstream by commit https://skia.googlesource.com/skia/+/875e13ca0990e32da9db639743a913efe77f7e89

I am right in the middle of updating Skia to the milestone 55 branch, which will include that fix, so all things considered I would just prefer to wait for the update to land so that we don't encounter any rebasing issues. That should happen in about a week or two.

Comment 5

[Lee Salzman [:lsalzman]]

Skia update landed for bug 1299435, so this is now fixed.