Bug 743499. Handle negative sizes in CG backend. r=bas, a=lsblakk
authorJeff Muizelaar <jmuizelaar@mozilla.com>
Mon, 07 May 2012 17:10:46 -0400
changeset 92176 c059029404f8416afc2774a2c673ec1b9f3e5a4b
parent 92175 abd73853ffc31776b5446d673637c873990c01bb
child 92177 a8aaf619dcef11b9f61be448d8bffda45ad9f1f2
push idunknown
push userunknown
push dateunknown
reviewersbas, lsblakk
bugs743499
milestone13.0
Bug 743499. Handle negative sizes in CG backend. r=bas, a=lsblakk I didn't realize Sizes could be negative when originally writing this code.
content/canvas/crashtests/743499-negative-size.html
content/canvas/crashtests/crashtests.list
gfx/2d/DrawTargetCG.cpp
new file mode 100644
--- /dev/null
+++ b/content/canvas/crashtests/743499-negative-size.html
@@ -0,0 +1,22 @@
+<html>
+<head>
+    <title></title>
+    <script type="text/javascript">
+        function go() {
+        var canvas = document.createElement("canvas");
+        var ctx = canvas.getContext('2d');
+        ctx.globalAlpha = 4
+        ctx.lineCap = "foo"
+        ctx.strokeRect(256,1024,8,4)
+        ctx.shadowColor = "black"
+        ctx.shadowOffsetY = 64
+        ctx.stroke()
+        ctx.moveTo(32,1024)
+        ctx.closePath()
+        }
+    </script>
+</head>
+<body onload="go()">
+<canvas id="canvas"></canvas>
+</body>
+</html>
\ No newline at end of file
--- a/content/canvas/crashtests/crashtests.list
+++ b/content/canvas/crashtests/crashtests.list
@@ -1,8 +1,9 @@
 load 360293-1.html
 load 421715-1.html
 load 553938-1.html
 load 647480.html
 load 0px-size-font-667225.html
 load texImage2D.html
 load 729116.html
 load 745699-1.html
+load 743499-negative-size.html
--- a/gfx/2d/DrawTargetCG.cpp
+++ b/gfx/2d/DrawTargetCG.cpp
@@ -867,17 +867,17 @@ DrawTargetCG::Init(CGContextRef cgContex
   return true;
 }
 
 bool
 DrawTargetCG::Init(const IntSize &aSize, SurfaceFormat &)
 {
   // XXX: we should come up with some consistent semantics for dealing
   // with zero area drawtargets
-  if (aSize.width == 0 || aSize.height == 0 ||
+  if (aSize.width <= 0 || aSize.height <= 0 ||
       // 32767 is the maximum size supported by cairo
       // we clamp to that to make it easier to interoperate
       aSize.width > 32767 || aSize.height > 32767) {
     mColorSpace = NULL;
     mCg = NULL;
     mData = NULL;
     return false;
   }