Closed Bug 801821 Opened 12 years ago Closed 8 years ago

Canvas clip & strokeText crash [@ CA::ScanConverter::Path::add_monotonic_cube]

Categories

(Core :: Graphics, defect)

x86_64
macOS
defect
Not set
critical

Tracking

()

RESOLVED WONTFIX

People

(Reporter: jruderman, Unassigned)

References

Details

(Keywords: crash, testcase)

Crash Data

Attachments

(4 files)

Firefox trunk, Mac OS X 10.7.5

With:
  user_pref("gfx.canvas.azure.accelerated", true);

This is similar to bug 799326 in three ways:

* The crash happens in the "CA::" module.
* The crash only happens with gfx.canvas.azure.accelerated = true
* If the canvas isn't in the document tree, the crash happens during shutdown 
instead of immediately.
Attached file stacks
Nightly: bp-90af29ce-739f-4b9c-95ea-9ec432121015
I believe this is related to the huge radius value passed to arcTo. It seems to require the translation though, unsure why that is.

I don't really know this code well enough to know if this is a bug in our arcTo implementation, or just a CA bug.

The points that we pass to bezierTo (within the arcTo implementation) are huge, but finite at least.

Example:

$12 = {
  <mozilla::gfx::BasePoint<float, mozilla::gfx::Point>> = {
    x = 6.76686969e+15, 
    y = 4.23787074e+14
  }, <No data fields>}
$13 = {
  <mozilla::gfx::BasePoint<float, mozilla::gfx::Point>> = {
    x = 2.99415243e+15, 
    y = -3.85304576e+15
  }, <No data fields>}
$14 = {
  <mozilla::gfx::BasePoint<float, mozilla::gfx::Point>> = {
    x = 3.30508176e+15, 
    y = -8.81785777e+15
  }, <No data fields>}

Bas, do you have any educated guesses here?

Safari manages not to crash here, so they are either decomposing arcTo differently, or they manage to detect invalid input and bail out (nothing gets drawn). I've had a browse though the WebKit source and can't see anything obvious.
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: