0ct0pu5/ladybird
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

LibWeb: Don't crash CPU painter if BorderRadiusSamplingConfig is invalid

Browse source
This commit is contained in:
Tim Ledbetter 2024-03-17 07:36:43 +00:00 • committed by Andreas Kling
parent a40c14462d
commit b61aab66d9
Notes: sideshowbarker 2024-07-17 01:11:48 +09:00
3 changed files with 31 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
Tests/LibWeb/Layout/expected/border-radius-invalid-corner-sampling-config.txt Normal file
View file

@ -0,0 +1,16 @@
Viewport <#document> at (0,0) content-size 800x600 children: not-inline
BlockContainer <html> at (0,0) content-size 800x33 [BFC] children: not-inline
BlockContainer <body> at (8,8) content-size 784x17 children: not-inline
BlockContainer <div> at (8,8) content-size 784x17 [BFC] children: inline
frag 0 from TextNode start: 0, length: 29, rect: [8,8 247.6875x17] baseline: 13.296875
"Test passes if we don't crash"
TextNode <#text>
BlockContainer <(anonymous)> at (8,25) content-size 784x0 children: inline
TextNode <#text>
ViewportPaintable (Viewport<#document>) [0,0 800x600]
PaintableWithLines (BlockContainer<HTML>) [0,0 800x33]
PaintableWithLines (BlockContainer<BODY>) [8,8 784x17]
PaintableWithLines (BlockContainer<DIV>) [8,8 784x17]
TextPaintable (TextNode<#text>)
PaintableWithLines (BlockContainer(anonymous)) [8,25 784x0]

7
Tests/LibWeb/Layout/input/border-radius-invalid-corner-sampling-config.html Normal file
View file

@ -0,0 +1,7 @@
<!DOCTYPE html><style>
div {
background-color: magenta;
border-top-left-radius: 1px 0px;
overflow: hidden;
}
</style><div>Test passes if we don't crash</div>

9
Userland/Libraries/LibWeb/Painting/CommandExecutorCPU.cpp
View file

@ -465,13 +465,20 @@ CommandResult CommandExecutorCPU::sample_under_corners(u32 id, CornerRadii const
m_corner_clippers.resize(id + 1);
auto clipper = BorderRadiusCornerClipper::create(corner_radii, border_rect.to_type<DevicePixels>(), corner_clip);
m_corner_clippers[id] = clipper.release_value_but_fixme_should_propagate_errors();
if (clipper.is_error()) {
m_corner_clippers[id] = nullptr;
return CommandResult::Continue;
}
m_corner_clippers[id] = clipper.release_value();
m_corner_clippers[id]->sample_under_corners(painter());
return CommandResult::Continue;
}
CommandResult CommandExecutorCPU::blit_corner_clipping(u32 id)
{
if (!m_corner_clippers[id])
return CommandResult::Continue;
m_corner_clippers[id]->blit_corner_clipping(painter());
m_corner_clippers[id] = nullptr;
return CommandResult::Continue;