Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-08 19:04:45 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1555851 - Detect motion path measurement failures. r=longsonr

Browse Source 
Differential Revision: https://phabricator.services.mozilla.com/D37337

--HG--
extra : moz-landing-system : lando
This commit is contained in:
Cameron McCormack 2019-07-09 01:26:52 +00:00
parent 43f890d3a4
commit b8f227ec6f
4 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
dom/svg/SVGMotionSMILAnimationFunction.cpp
View File

@ -240,6 +240,7 @@ void SVGMotionSMILAnimationFunction::RebuildPathAndVerticesFromPathAttr() {
bool ok = path.GetDistancesFromOriginToEndsOfVisibleSegments(&mPathVertices);
if (!ok || !mPathVertices.Length()) {
mPath = nullptr;
mPathVertices.Clear();
}
}

6
dom/svg/SVGPathData.cpp
View File

@ -165,6 +165,12 @@ bool SVGPathData::GetDistancesFromOriginToEndsOfVisibleSegments(
uint32_t segType = SVGPathSegUtils::DecodeType(mData[i]);
SVGPathSegUtils::TraversePathSegment(&mData[i], state);
// With degenerately large point coordinates, TraversePathSegment can fail
// and end up producing NaNs.
if (!isfinite(state.length)) {
return false;
}
// We skip all moveto commands except an initial moveto. See the text 'A
// "move to" command does not count as an additional point when dividing up
// the duration...':

8
layout/svg/crashtests/1555851.html Normal file
View File

@ -0,0 +1,8 @@
<body>
<script>
var o0 = document.createElementNS("http://www.w3.org/2000/svg", "svg")
document.body.appendChild(o0)
var o3 = document.createElementNS("http://www.w3.org/2000/svg", "animateMotion")
o0.appendChild(o3)
o3.setAttribute("path", "M9,2l2e37,3A40,2 85,102-1")
</script>

1
layout/svg/crashtests/crashtests.list
View File

@ -229,3 +229,4 @@ load 1536892.html
load 1539318-1.svg
load 1548985-1.html
load 1548985-2.svg
load 1555851.html