Null-check frame (which is needed when bounds width/height is zero) and clamp negative values to zero. b=570884 r=josh
authorMats Palmgren <matspal@gmail.com>
Wed, 09 Jun 2010 21:07:41 +0200
changeset 43407 3b326ae18eba057b9368d75cb2dde732745476bc
parent 43406 675bf54fbe934ece5124398d5fca8b4ba305f3b3
child 43408 b3404e64afade2774aca7fcff5221bec22cac6bd
push idunknown
push userunknown
push dateunknown
reviewersjosh
bugs570884
milestone1.9.3a5pre
Null-check frame (which is needed when bounds width/height is zero) and clamp negative values to zero. b=570884 r=josh
modules/plugin/test/crashtests/570884.html
modules/plugin/test/crashtests/crashtests.list
modules/plugin/test/testplugin/nptest_macosx.mm
new file mode 100644
--- /dev/null
+++ b/modules/plugin/test/crashtests/570884.html
@@ -0,0 +1,8 @@
+<body>
+<embed type="application/x-test" width="20"></embed>
+<embed type="application/x-test" width="10"></embed>
+<embed type="application/x-test" width="0"></embed>
+<embed type="application/x-test" width="20" height="20"></embed>
+<embed type="application/x-test" width="10" height="10"></embed>
+<embed type="application/x-test" width="0" height="0"></embed>
+</body>
--- a/modules/plugin/test/crashtests/crashtests.list
+++ b/modules/plugin/test/crashtests/crashtests.list
@@ -1,6 +1,7 @@
 load 41276-1.html
 load 48856-1.html
 
 load 110650-1.html
 skip-if(MOZ_WIDGET_TOOLKIT=="cocoa") script 539897-1.html
 script 540114-1.html
+load 570884.html
--- a/modules/plugin/test/testplugin/nptest_macosx.mm
+++ b/modules/plugin/test/testplugin/nptest_macosx.mm
@@ -184,17 +184,18 @@ pluginDraw(InstanceData* instanceData, N
     CGContextSetLineWidth(cgContext, 6.0);
     CGContextStrokePath(cgContext);
 
     // draw the UA string using Core Text
     CGContextSetTextMatrix(cgContext, CGAffineTransformIdentity);
 
     // Initialize a rectangular path.
     CGMutablePathRef path = CGPathCreateMutable();
-    CGRect bounds = CGRectMake(10.0, 10.0, windowWidth - 20.0, windowHeight - 20.0);
+    CGRect bounds = CGRectMake(10.0, 10.0, PR_MAX(0.0, windowWidth - 20.0),
+                               PR_MAX(0.0, windowHeight - 20.0));
     CGPathAddRect(path, NULL, bounds);
 
     // Initialize an attributed string.
     CFMutableAttributedStringRef attrString = CFAttributedStringCreateMutable(kCFAllocatorDefault, 0);
     CFAttributedStringReplaceString(attrString, CFRangeMake(0, 0), uaCFString);
 
     // Create a color and add it as an attribute to the string.
     CGColorSpaceRef rgbColorSpace = CGColorSpaceCreateDeviceRGB();
@@ -205,18 +206,20 @@ pluginDraw(InstanceData* instanceData, N
 
     // Create the framesetter with the attributed string.
     CTFramesetterRef framesetter = CTFramesetterCreateWithAttributedString(attrString);
     CFRelease(attrString);
 
     // Create the frame and draw it into the graphics context
     CTFrameRef frame = CTFramesetterCreateFrame(framesetter, CFRangeMake(0, 0), path, NULL);
     CFRelease(framesetter);
-    CTFrameDraw(frame, cgContext);
-    CFRelease(frame);
+    if (frame) {
+      CTFrameDraw(frame, cgContext);
+      CFRelease(frame);
+    }
 
     // restore the cgcontext gstate
     CGContextRestoreGState(cgContext);
     break;
   }
   case DM_SOLID_COLOR: {
     // save the cgcontext gstate
     CGContextSaveGState(cgContext);