Skip to site navigation (Press enter)

[webkit-changes] [132844] trunk

hclam Mon, 29 Oct 2012 13:55:53 -0700

Title: [132844] trunk

Revision: 132844
Author: [email protected]
Date: 2012-10-29 13:57:13 -0700 (Mon, 29 Oct 2012)

Log Message

[skia] Handle mask box image.
https://bugs.webkit.org/show_bug.cgi?id=100570


Reviewed by James Robinson.

Source/WebCore:

When drawing an image with source rectangle it should intersect with image rectangle.
This should be the case for drawing single image and tiling an image.

Test: fast/images/mask-box-image-crash.html

* platform/graphics/skia/ImageSkia.cpp:
(WebCore::Image::drawPattern):
(WebCore::BitmapImage::draw):
(WebCore::BitmapImageSingleFrameSkia::draw):

LayoutTests:

Added a test for -webkit-mask-box-image. Test should complete without crashes.
Output image should be blank.

* fast/images/mask-box-image-crash-expected.png: Added.
* fast/images/mask-box-image-crash-expected.txt: Added.
* fast/images/mask-box-image-crash.html: Added.

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/platform/graphics/skia/ImageSkia.cpp

Added Paths

trunk/LayoutTests/fast/images/mask-box-image-crash-expected.png
trunk/LayoutTests/fast/images/mask-box-image-crash-expected.txt
trunk/LayoutTests/fast/images/mask-box-image-crash.html

Diff

Modified: trunk/LayoutTests/ChangeLog (132843 => 132844)


--- trunk/LayoutTests/ChangeLog	2012-10-29 20:16:48 UTC (rev 132843)
+++ trunk/LayoutTests/ChangeLog	2012-10-29 20:57:13 UTC (rev 132844)
@@ -1,3 +1,17 @@
+2012-10-29  Alpha Lam  <[email protected]>
+
+        [skia] Handle mask box image.
+        https://bugs.webkit.org/show_bug.cgi?id=100570
+
+        Reviewed by James Robinson.
+
+        Added a test for -webkit-mask-box-image. Test should complete without crashes.
+        Output image should be blank.
+
+        * fast/images/mask-box-image-crash-expected.png: Added.
+        * fast/images/mask-box-image-crash-expected.txt: Added.
+        * fast/images/mask-box-image-crash.html: Added.
+
 2012-10-29  David Barton  <[email protected]>
 
         Unreviewed gardening. LayoutTests/mathml/msubsup-fuzz.html passes locally but not on

Added: trunk/LayoutTests/fast/images/mask-box-image-crash-expected.png (0 => 132844)


--- trunk/LayoutTests/fast/images/mask-box-image-crash-expected.png	                        (rev 0)
+++ trunk/LayoutTests/fast/images/mask-box-image-crash-expected.png	2012-10-29 20:57:13 UTC (rev 132844)
@@ -0,0 +1,6 @@
+\x89PNG
+
+
+IHDR X')tEXtchecksum853de00567d121bea0b7bece66a5d61c`7\xFF\xFB
+\xAAIDATx\x9C\xED\xD6\xC1	 \xC00u\xFF\x9D\xCF%
+\x82$\xF4\xD9=3\x80\xCEy\xF0\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X1\x833X\xB1d\xAD4\xD1ӅIEND\xAEB`\x82
\ No newline at end of file

Added: trunk/LayoutTests/fast/images/mask-box-image-crash-expected.txt (0 => 132844)


--- trunk/LayoutTests/fast/images/mask-box-image-crash-expected.txt	                        (rev 0)
+++ trunk/LayoutTests/fast/images/mask-box-image-crash-expected.txt	2012-10-29 20:57:13 UTC (rev 132844)
@@ -0,0 +1 @@
+

Added: trunk/LayoutTests/fast/images/mask-box-image-crash.html (0 => 132844)


--- trunk/LayoutTests/fast/images/mask-box-image-crash.html	                        (rev 0)
+++ trunk/LayoutTests/fast/images/mask-box-image-crash.html	2012-10-29 20:57:13 UTC (rev 132844)
@@ -0,0 +1,16 @@
+<script>
+if (window.testRunner)
+    testRunner.dumpAsText(true);
+</script>
+<fieldset style="-webkit-margin-end: 99999;
+                 -webkit-mask-box-image: url('data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAE\
+                 IAAABCAQAAAADLLz1FAAAACXZwQWcAAABCAAAAQgCVDTvpAAAAFElEQVQoz2P4DwUHGEZZo6xBwQI\
+                 ANWY/j0PofaAAAAAASUVORK5CYII=') 10000% 10000 9999999999%;">
+</fieldset>
+<div style="position: absolute;
+            top: 0px;
+            left: 0px;
+            width: 100px;
+            height: 100px;
+            z-index: 1;
+            background-color: white;"></div>

Modified: trunk/Source/WebCore/ChangeLog (132843 => 132844)


--- trunk/Source/WebCore/ChangeLog	2012-10-29 20:16:48 UTC (rev 132843)
+++ trunk/Source/WebCore/ChangeLog	2012-10-29 20:57:13 UTC (rev 132844)
@@ -1,3 +1,20 @@
+2012-10-29  Alpha Lam  <[email protected]>
+
+        [skia] Handle mask box image.
+        https://bugs.webkit.org/show_bug.cgi?id=100570
+
+        Reviewed by James Robinson.
+
+        When drawing an image with source rectangle it should intersect with image rectangle.
+        This should be the case for drawing single image and tiling an image.
+
+        Test: fast/images/mask-box-image-crash.html
+
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::Image::drawPattern):
+        (WebCore::BitmapImage::draw):
+        (WebCore::BitmapImageSingleFrameSkia::draw):
+
 2012-10-29  Eric Carlson  <[email protected]>
 
         Support captions when PLUGIN_PROXY_FOR_VIDEO

Modified: trunk/Source/WebCore/platform/graphics/skia/ImageSkia.cpp (132843 => 132844)


--- trunk/Source/WebCore/platform/graphics/skia/ImageSkia.cpp	2012-10-29 20:16:48 UTC (rev 132843)
+++ trunk/Source/WebCore/platform/graphics/skia/ImageSkia.cpp	2012-10-29 20:57:13 UTC (rev 132844)
@@ -472,14 +472,15 @@
 #if PLATFORM(CHROMIUM)
     TRACE_EVENT0("skia", "Image::drawPattern");
 #endif
+    NativeImageSkia* bitmap = nativeImageForCurrentFrame();
+    if (!bitmap)
+        return;
+
     FloatRect normSrcRect = normalizeRect(floatSrcRect);
+    normSrcRect.intersect(FloatRect(0, 0, bitmap->bitmap().width(), bitmap->bitmap().height()));
     if (destRect.isEmpty() || normSrcRect.isEmpty())
         return; // nothing to draw
 
-    NativeImageSkia* bitmap = nativeImageForCurrentFrame();
-    if (!bitmap)
-        return;
-
     SkMatrix ctm = context->platformContext()->canvas()->getTotalMatrix();
     SkMatrix totalMatrix;
     totalMatrix.setConcat(ctm, patternTransform);
@@ -605,6 +606,7 @@
 
     FloatRect normDstRect = normalizeRect(dstRect);
     FloatRect normSrcRect = normalizeRect(srcRect);
+    normSrcRect.intersect(FloatRect(0, 0, bm->bitmap().width(), bm->bitmap().height()));
 
     if (normSrcRect.isEmpty() || normDstRect.isEmpty())
         return; // Nothing to draw.
@@ -650,6 +652,7 @@
 {
     FloatRect normDstRect = normalizeRect(dstRect);
     FloatRect normSrcRect = normalizeRect(srcRect);
+    normSrcRect.intersect(FloatRect(0, 0, m_nativeImage.bitmap().width(), m_nativeImage.bitmap().height()));
 
     if (normSrcRect.isEmpty() || normDstRect.isEmpty())
         return; // Nothing to draw.

_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes