Skip to content

Commit

Permalink
css-text-decor: fix crash in ComputeWavyPatternRect for small curves
Browse files Browse the repository at this point in the history 
ComputeWavyPatternRect returns a rect representing the bounds of one
cycle of the given wavy pattern, expanding the top and bottom edges
to the nearest integer y values. In particular, we round the top y
value to -∞ with -ceil(abs(y)), which requires us to assert that y<0
to ensure the sign doesn’t flip.

Unfortunately this is not always true, because PrepareWavyStrokePath
offsets the curve by (0,0.5) to reduce vertical antialiasing.

      x=0
        |------------------------|
        |.                      .|
        |  .                  .  |
y=  0 __|____.______________.____|
  0.5 --|------+-----------.-----|
        |       .         .      |
        |         .     .        |
        |           . .          |
        |------------------------|

If the amplitude of the curve is small enough, the StrokeBoundingRect
can fall entirely between y=0 and y=1.

      x=0
y=  0 --|------------------------|
        |.                      .|
        |  .                  .  |
        |    .              .    |
  0.5 --|------+-----------.-----|
        |       .         .      |
        |         .     .        |
        |           . .          |
    1 --|------------------------|

This can happen even if the upper control point itself has y<0, since
béziér curves can have tighter bounds than the min/max of all of their
points. For example, given the following, the StrokeBoundingRect would
be (-1.23219,0.0142169) 4.71437x0.971566, even though cp2 has y=-0.75:

    start = (-1.125,0.5)
    cp1 = (-0.375,1.75)
    cp2 = (-0.375,-0.75)
    end = (0.375,0.5)

The correct assertion is y<0.5, but -ceil(abs(y)) would round small
positive y values incorrectly anyway. This patch replaces it with
floor(y), which always rounds towards -∞.

Fixed: 1393709
Change-Id: I4557a67dd42eb06e1942f3bec4ebcbaeb79ef211
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4065062
Reviewed-by: Philip Rogers <pdr@chromium.org>
Commit-Queue: Delan Azabani <dazabani@igalia.com>
Reviewed-by: Koji Ishii <kojii@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1078150}
  • Loading branch information
@delan @pull
delan authored and pull[bot] committed Jan 5, 2024
1 parent 6b62f11 commit 28beda6
Showing 1 changed file with 6 additions and 0 deletions.
6 changes: 6 additions & 0 deletions css/css-text-decor/text-decoration-line-spelling-error-001-crash.html
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
<!doctype html><meta charset="utf-8">
<title>CSS Text Decoration Test: spelling error with very small zoom</title>
<link rel="author" name="Delan Azabani" href="mailto:dazabani@igalia.com">
<link rel="help" href="https://crbug.com/1393709">
<meta name="assert" value="Checks that spelling error decorations will not cause a crash, even if the ‘zoom’ property is set to a very small value.">
<body style="text-decoration: spelling-error; zoom: 0.18511807360331467;">quikc

0 comments on commit 28beda6

Please sign in to comment.