Commit 61cd574c authored by zherczeg@webkit.org's avatar zherczeg@webkit.org
Browse files

WebCore: Fix a crash caused by feLigthing::apply()

https://bugs.webkit.org/show_bug.cgi?id=39004

Reviewed by Dirk Schulze.

Make FELighting::apply() similar to other filters' applies
to avoid an assertion fail in putUnmultipliedImageData(),
when effectDrawingRect has negative location (x or y is less than 0).

Test: svg/filters/feLighting-crash.svg

* svg/graphics/filters/SVGFELighting.cpp:
(WebCore::FELighting::apply):

LayoutTests: In case of lighting SVG effects, a wider output rectangle
than the input image size should not cause crash.
https://bugs.webkit.org/show_bug.cgi?id=39004

Reviewed by Dirk Schulze.

* platform/mac/svg/filters/feLighting-crash-expected.checksum: Added.
* platform/mac/svg/filters/feLighting-crash-expected.png: Added.
* platform/mac/svg/filters/feLighting-crash-expected.txt: Added.
* platform/qt/svg/filters/feLighting-crash-expected.txt: Added.
* svg/filters/feLighting-crash.svg: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@59832 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent 873b6db3
2010-05-20 Zoltan Herczeg <zherczeg@webkit.org>
Reviewed by Dirk Schulze.
In case of lighting SVG effects, a wider output rectangle
than the input image size should not cause crash.
https://bugs.webkit.org/show_bug.cgi?id=39004
* platform/mac/svg/filters/feLighting-crash-expected.checksum: Added.
* platform/mac/svg/filters/feLighting-crash-expected.png: Added.
* platform/mac/svg/filters/feLighting-crash-expected.txt: Added.
* platform/qt/svg/filters/feLighting-crash-expected.txt: Added.
* svg/filters/feLighting-crash.svg: Added.
2010-05-20 MORITA Hajime <morrita@google.com>
 
Reviewed by Kent Tamura.
a6802e24ad67774532422290965d5eeb
\ No newline at end of file
layer at (0,0) size 800x600
RenderView at (0,0) size 800x600
layer at (0,0) size 800x600
RenderSVGRoot {svg} at (0,0) size 800x600
RenderSVGHiddenContainer {defs} at (0,0) size 0x0
RenderSVGResourceFilter {filter} [id="light"] [filterUnits=objectBoundingBox] [primitiveUnits=userSpaceOnUse]
[feSpecularLighting surfaceScale="5.00" specualConstant="10.00" specularExponent="6.00"]
[SourceGraphic]
RenderPath {rect} at (0,0) size 44x22 [fill={[type=SOLID] [color=#000000]}] [data="M0.00,0.00 L40.00,0.00 L40.00,20.00 L0.00,20.00 Z"]
[filter="light"] RenderSVGResourceFilter {filter} at (-4,-2) size 48x24
layer at (0,0) size 800x600
RenderView at (0,0) size 800x600
layer at (0,0) size 800x600
RenderSVGRoot {svg} at (0,0) size 800x600
RenderSVGHiddenContainer {defs} at (0,0) size 0x0
RenderSVGResourceFilter {filter} [id="light"] [filterUnits=objectBoundingBox] [primitiveUnits=userSpaceOnUse]
[feSpecularLighting surfaceScale="5.00" specualConstant="10.00" specularExponent="6.00"]
[SourceGraphic]
RenderPath {rect} at (0,0) size 44x22 [fill={[type=SOLID] [color=#000000]}] [data="M0.00,0.00 L40.00,0.00 L40.00,20.00 L0.00,20.00 Z"]
[filter="light"] RenderSVGResourceFilter {filter} at (-4,-2) size 48x24
<svg xmlns="http://www.w3.org/2000/svg">
<defs>
<filter id="light" primitiveUnits="userSpaceOnUse">
<feSpecularLighting lighting-color="blue" surfaceScale="5" specularConstant="10" specularExponent="6">
<feDistantLight azimuth="0" elevation="30"/>
</feSpecularLighting>
</filter>
</defs>
<rect width="40" height="20" filter="url(#light)" fill="black"/>
</svg>
2010-05-20 Zoltan Herczeg <zherczeg@webkit.org>
Reviewed by Dirk Schulze.
Fix a crash caused by feLigthing::apply()
https://bugs.webkit.org/show_bug.cgi?id=39004
Make FELighting::apply() similar to other filters' applies
to avoid an assertion fail in putUnmultipliedImageData(),
when effectDrawingRect has negative location (x or y is less than 0).
Test: svg/filters/feLighting-crash.svg
* svg/graphics/filters/SVGFELighting.cpp:
(WebCore::FELighting::apply):
2010-05-20 Chris Jerdonek <cjerdonek@webkit.org>
 
Reviewed by Eric Seidel.
......@@ -254,7 +254,6 @@ void FELighting::apply(Filter* filter)
setIsAlphaImage(false);
IntRect effectDrawingRect = calculateDrawingIntRect(m_in->scaledSubRegion());
RefPtr<ImageData> srcImageData(m_in->resultImage()->getUnmultipliedImageData(effectDrawingRect));
CanvasPixelArray* srcPixelArray(srcImageData->data());
......@@ -264,7 +263,7 @@ void FELighting::apply(Filter* filter)
// Anyway, feConvolveMatrix should also use the implementation
if (drawLighting(srcPixelArray, effectDrawingRect.width(), effectDrawingRect.height()))
resultImage()->putUnmultipliedImageData(srcImageData.get(), IntRect(IntPoint(), effectDrawingRect.size()), effectDrawingRect.location());
resultImage()->putUnmultipliedImageData(srcImageData.get(), IntRect(IntPoint(), resultImage()->size()), IntPoint());
}
} // namespace WebCore
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment