801821 - Canvas clip & strokeText crash [@ CA::ScanConverter::Path::add_monotonic_cube]

Status: RESOLVED WONTFIX

(Core :: Graphics, defect)

Description

[Jesse Ruderman]

Attachment: testcase (crashes Firefox when loaded)

Firefox trunk, Mac OS X 10.7.5

With:
  user_pref("gfx.canvas.azure.accelerated", true);

This is similar to bug 799326 in three ways:

* The crash happens in the "CA::" module.
* The crash only happens with gfx.canvas.azure.accelerated = true
* If the canvas isn't in the document tree, the crash happens during shutdown 
instead of immediately.

Comment 1

[Jesse Ruderman]

Attachment: stacks

Nightly: bp-90af29ce-739f-4b9c-95ea-9ec432121015

Comment 2

[Matt Woodrow (:mattwoodrow)]

Attachment: Reduced test case

Comment 3

[Matt Woodrow (:mattwoodrow)]

I believe this is related to the huge radius value passed to arcTo. It seems to require the translation though, unsure why that is.

I don't really know this code well enough to know if this is a bug in our arcTo implementation, or just a CA bug.

The points that we pass to bezierTo (within the arcTo implementation) are huge, but finite at least.

Example:

$12 = {
  <mozilla::gfx::BasePoint<float, mozilla::gfx::Point>> = {
    x = 6.76686969e+15, 
    y = 4.23787074e+14
  }, <No data fields>}
$13 = {
  <mozilla::gfx::BasePoint<float, mozilla::gfx::Point>> = {
    x = 2.99415243e+15, 
    y = -3.85304576e+15
  }, <No data fields>}
$14 = {
  <mozilla::gfx::BasePoint<float, mozilla::gfx::Point>> = {
    x = 3.30508176e+15, 
    y = -8.81785777e+15
  }, <No data fields>}

Bas, do you have any educated guesses here?

Safari manages not to crash here, so they are either decomposing arcTo differently, or they manage to detect invalid input and bail out (nothing gets drawn). I've had a browse though the WebKit source and can't see anything obvious.

Comment 4

[Matt Woodrow (:mattwoodrow)]

Attachment: Add crashtests for these bugs

Comment 5

[Virtual_ManPL [:Virtual] 🇵🇱 - (please needinfo? me - so I will see your comment/message/reply/question/etc.)]

Per bug #836130 comment #24