330602 - Crash with textPath text going off end of path

Status: RESOLVED FIXED

(Core :: SVG, defect)

Description

[tor]

On linux sometimes the branch with textPath (bug 327539) crashes inside cairo, with the textcase on bug 306547.  This appears to be caused by us trying to do operations on characters that fall off the end of the path.  Handing NaN as the position/angle causes an invalid scale matrix to be set, which then messes up the font backend.

Comment 1

[tor]

Attachment: branch patch

Comment 2

[tor]

Attachment: trunk patch

Comment 3

[tor]

Attachment: branch patch - allow for text spill off start and end of path

Comment 4

[tor]

Attachment: trunk patch - allow for text spill off start and end of path

Comment 5

[Robert Longson [:longsonr]]

Comment on attachment 215163 [details] [diff] [review]
trunk patch - allow for text spill off start and end of path

Branch and Trunk...

Calls to cairo_get_matrix have a corresponding cairo_set_matrix except with the change to nsSVGCairoGlyphGeometry::ContainsPoint. Do we need to ensure this continues to be so? In which case the cairo_get_matrix call could be moved (and duplicated so that it occurs within the if (after the draw test) and in the else.

Trunk only...
nsSVGCairoGlyphMetrics::GetCharNumAtPosition

We should not give up and return an error if cp[charnum].draw is FALSE, merely ignore this character (using continue) and presumably carry on to check the next character. May need to restructure things a little to ensure cairo_get_matrix and cairo_set_matrix calls still balance assuming the first comment is correct.

Comment 6

[Robert Longson [:longsonr]]

Or alternatively stick a call to cairo_set_matrix if draw is FALSE before the continue where appropriate

Comment 7

[tor]

Attachment: trunk patch - adjusted per comments

It's safe to call cairo_get_matrix() unbalanced, as it doesn't change the state of the cairo content.  However I've adjusted the logic to avoid that.

Comment 8

[Robert Longson [:longsonr]]

Comment on attachment 215260 [details] [diff] [review]
trunk patch - adjusted per comments

What do you want to do about the branch patch? I guess you can fix it up when you check it in if you want.

Comment 9

[tor]

Attachment: branch patch - adjusted per comments

Comment 10

[tor]

Checked in.