Bug 601131 - Hang with feTurbulence with huge numOctaves. r=roc
authorRobert Longson <longsonr@gmail.com>
Mon, 24 Jun 2013 10:42:22 +0100
changeset 147715 7edda78eca8bc23c99cebfcab24ccd8838d09f16
parent 147714 6c3acc2030b014ad0f722cca7b6ae9cba2ae85c6
child 147727 999f162be482e596557a6e1165108cde466debb3
child 147744 d53ba2cc53370cebabb8d87bda8d894454212476
push id2697
push userbbajaj@mozilla.com
push dateMon, 05 Aug 2013 18:49:53 +0000
treeherdermozilla-beta@dfec938c7b63 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersroc
bugs601131
milestone24.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 601131 - Hang with feTurbulence with huge numOctaves. r=roc
content/svg/content/src/SVGFETurbulenceElement.cpp
--- a/content/svg/content/src/SVGFETurbulenceElement.cpp
+++ b/content/svg/content/src/SVGFETurbulenceElement.cpp
@@ -18,16 +18,18 @@ static const unsigned short SVG_TURBULEN
 static const unsigned short SVG_TURBULENCE_TYPE_FRACTALNOISE = 1;
 static const unsigned short SVG_TURBULENCE_TYPE_TURBULENCE = 2;
 
 // Stitch Options
 static const unsigned short SVG_STITCHTYPE_UNKNOWN = 0;
 static const unsigned short SVG_STITCHTYPE_STITCH = 1;
 static const unsigned short SVG_STITCHTYPE_NOSTITCH = 2;
 
+static const int32_t MAX_OCTAVES = 10;
+
 JSObject*
 SVGFETurbulenceElement::WrapNode(JSContext* aCx, JS::Handle<JSObject*> aScope)
 {
   return SVGFETurbulenceElementBinding::Wrap(aCx, aScope, this);
 }
 
 nsSVGElement::NumberInfo SVGFETurbulenceElement::sNumberInfo[1] =
 {
@@ -132,17 +134,17 @@ SVGFETurbulenceElement::Filter(nsSVGFilt
   nsIntRect filterSubregion(int32_t(aTarget->mFilterPrimitiveSubregion.X()),
                             int32_t(aTarget->mFilterPrimitiveSubregion.Y()),
                             int32_t(aTarget->mFilterPrimitiveSubregion.Width()),
                             int32_t(aTarget->mFilterPrimitiveSubregion.Height()));
 
   float fX = mNumberPairAttributes[BASE_FREQ].GetAnimValue(nsSVGNumberPair::eFirst);
   float fY = mNumberPairAttributes[BASE_FREQ].GetAnimValue(nsSVGNumberPair::eSecond);
   float seed = mNumberAttributes[OCTAVES].GetAnimValue();
-  int32_t octaves = mIntegerAttributes[OCTAVES].GetAnimValue();
+  int32_t octaves = std::min(mIntegerAttributes[OCTAVES].GetAnimValue(), MAX_OCTAVES);
   uint16_t type = mEnumAttributes[TYPE].GetAnimValue();
   uint16_t stitch = mEnumAttributes[STITCHTILES].GetAnimValue();
 
   InitSeed((int32_t)seed);
 
   // XXXroc this makes absolutely no sense to me.
   float filterX = instance->GetFilterRegion().X();
   float filterY = instance->GetFilterRegion().Y();