Sfoglia il codice sorgente

LibWeb: Don't crash CPU painter if BorderRadiusSamplingConfig is invalid

Tim Ledbetter 1 anno fa
parent
commit
b61aab66d9

+ 16 - 0
Tests/LibWeb/Layout/expected/border-radius-invalid-corner-sampling-config.txt

@@ -0,0 +1,16 @@
+Viewport <#document> at (0,0) content-size 800x600 children: not-inline
+  BlockContainer <html> at (0,0) content-size 800x33 [BFC] children: not-inline
+    BlockContainer <body> at (8,8) content-size 784x17 children: not-inline
+      BlockContainer <div> at (8,8) content-size 784x17 [BFC] children: inline
+        frag 0 from TextNode start: 0, length: 29, rect: [8,8 247.6875x17] baseline: 13.296875
+            "Test passes if we don't crash"
+        TextNode <#text>
+      BlockContainer <(anonymous)> at (8,25) content-size 784x0 children: inline
+        TextNode <#text>
+
+ViewportPaintable (Viewport<#document>) [0,0 800x600]
+  PaintableWithLines (BlockContainer<HTML>) [0,0 800x33]
+    PaintableWithLines (BlockContainer<BODY>) [8,8 784x17]
+      PaintableWithLines (BlockContainer<DIV>) [8,8 784x17]
+        TextPaintable (TextNode<#text>)
+      PaintableWithLines (BlockContainer(anonymous)) [8,25 784x0]

+ 7 - 0
Tests/LibWeb/Layout/input/border-radius-invalid-corner-sampling-config.html

@@ -0,0 +1,7 @@
+<!DOCTYPE html><style>
+div {
+    background-color: magenta;
+    border-top-left-radius: 1px 0px;
+    overflow: hidden;
+}
+</style><div>Test passes if we don't crash</div>

+ 8 - 1
Userland/Libraries/LibWeb/Painting/CommandExecutorCPU.cpp

@@ -465,13 +465,20 @@ CommandResult CommandExecutorCPU::sample_under_corners(u32 id, CornerRadii const
         m_corner_clippers.resize(id + 1);
         m_corner_clippers.resize(id + 1);
 
 
     auto clipper = BorderRadiusCornerClipper::create(corner_radii, border_rect.to_type<DevicePixels>(), corner_clip);
     auto clipper = BorderRadiusCornerClipper::create(corner_radii, border_rect.to_type<DevicePixels>(), corner_clip);
-    m_corner_clippers[id] = clipper.release_value_but_fixme_should_propagate_errors();
+    if (clipper.is_error()) {
+        m_corner_clippers[id] = nullptr;
+        return CommandResult::Continue;
+    }
+    m_corner_clippers[id] = clipper.release_value();
     m_corner_clippers[id]->sample_under_corners(painter());
     m_corner_clippers[id]->sample_under_corners(painter());
     return CommandResult::Continue;
     return CommandResult::Continue;
 }
 }
 
 
 CommandResult CommandExecutorCPU::blit_corner_clipping(u32 id)
 CommandResult CommandExecutorCPU::blit_corner_clipping(u32 id)
 {
 {
+    if (!m_corner_clippers[id])
+        return CommandResult::Continue;
+
     m_corner_clippers[id]->blit_corner_clipping(painter());
     m_corner_clippers[id]->blit_corner_clipping(painter());
     m_corner_clippers[id] = nullptr;
     m_corner_clippers[id] = nullptr;
     return CommandResult::Continue;
     return CommandResult::Continue;