840869 - division-by-zero possible in gfxFont::Draw when mAdjusted == 0.0

Status: RESOLVED FIXED

(Core :: Graphics: Text, defect)

Description

[Oleg Romashin (:romaxa)]

while testing skia backend (Gtk/Qt) I found that we have division by 0.0f here:
http://hg.mozilla.org/mozilla-central/diff/9fd54e12e670/gfx/thebes/gfxFont.cpp#l1.272,

which breaks matrix and later crashes in scaled cairo font creation

Comment 1

[Oleg Romashin (:romaxa)]

Attachment: Avoid 0.0f division

Comment 2

[Daniel Holbert [:dholbert]]

Comment on attachment 713283 [details] [diff] [review]
Avoid 0.0f division

># HG changeset patch
># User Oleg Romashin <[e-mail]>
># Parent d509e44cae3effde6814bb08c7c8cf9808197917
>Bug 840869 - NULL Pointer division possible in gfxFont::Draw when mAdjusted == 0.0. r=bas

Drive-by nit: This doesn't have anything to do with pointers or NULL; I tweaked the bug-summary, but you should probably tweak the patch's commit message, too.

(Also, it'd be better if the checkin comment described the change rather than the problem, per https://developer.mozilla.org/en-US/docs/Developer_Guide/Committing_Rules_and_Responsibilities#Checkin_comment )

Comment 3

[Oleg Romashin (:romaxa)]

oh, yep you right... I guess I first created bug with wrong comment and later copied it into patch header

Comment 4

[Oleg Romashin (:romaxa)]

mAdjusted - is 0.0 here because PangoFonts dount touch that value at all
http://mxr.mozilla.org/mozilla-central/search?string=mAdjusted

Comment 5

[Bas Schouten (:bas.schouten)]

Comment on attachment 713283 [details] [diff] [review]
Avoid 0.0f division

Review of attachment 713283 [details] [diff] [review]:
-----------------------------------------------------------------

::: gfx/thebes/gfxFont.cpp
@@ +2044,5 @@
>            // the glyphs, and not to their position.
>            mat = ToMatrix(*reinterpret_cast<gfxMatrix*>(&matrix));
>  
>            mat._11 = mat._22 = 1.0;
> +          float adjustedSize = mAdjustedSize ? mAdjustedSize : GetStyle()->size;

Since mAdjusted size is a float, please do mAdjustedSize > 0.

Comment 6

[Oleg Romashin (:romaxa)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/d73b0524cb1f

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/d73b0524cb1f

Is it possible to create a test for this?