Fix svg/custom/path-getTotalLength.svg

Path::apply creates a PathElement and its points array on the stack,
to fill it in from the QPainterPath data and then use the platform
independent path applier functions to calculate properties such as
the length. For converting a QPainterPath::CurveToElement we need
three points in the path element. However we allocated only two
on the stack and as a result we got memory corruption and the
failing test.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@29619 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index ced372c..a04499e 100644 (file)
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -2,6 +2,24 @@
 
         Reviewed by Holger.
 
+        Fix svg/custom/path-getTotalLength.svg
+        
+        Path::apply creates a PathElement and its points array on the stack,
+        to fill it in from the QPainterPath data and then use the platform
+        independent path applier functions to calculate properties such as
+        the length. For converting a QPainterPath::CurveToElement we need
+        three points in the path element. However we allocated only two
+        on the stack and as a result we got memory corruption and the
+        failing test.
+        
+
+        * platform/graphics/qt/PathQt.cpp:
+        (WebCore::Path::apply):
+
+2008-01-18  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Holger.
+
         Fix LayoutTests/fast/dom/document-attribute-js-null.html
         
         Don't crash when trying to get/set cookies without a frameloader.

diff --git a/WebCore/platform/graphics/qt/PathQt.cpp b/WebCore/platform/graphics/qt/PathQt.cpp
index 8bbcfbc..240350f 100644 (file)
--- a/WebCore/platform/graphics/qt/PathQt.cpp
+++ b/WebCore/platform/graphics/qt/PathQt.cpp
@@ -224,7 +224,7 @@ String Path::debugString() const
 void Path::apply(void* info, PathApplierFunction function) const
 {
     PathElement pelement;
-    FloatPoint points[2];
+    FloatPoint points[3];
     pelement.points = points;
     for (int i = 0; i < m_path->elementCount(); ++i) {
         const QPainterPath::Element& cur = m_path->elementAt(i);