git://git.webkit.org / WebKit-https.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: f2b6af0)
SIGFPE @ int WebCore::SVGToOTFFontConverter::scaleUnitsPerEm<int> const + 45
authordino@apple.com <dino@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 20 Feb 2018 00:04:40 +0000 (00:04 +0000)
committerdino@apple.com <dino@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 20 Feb 2018 00:04:40 +0000 (00:04 +0000)
https://bugs.webkit.org/show_bug.cgi?id=182944
<rdar://problem/35369984>

Reviewed by Myles Maxfield.

Source/WebCore:

Avoid a divide-by-zero.

Test: svg/text/font-bad-unitsperem.html

* svg/SVGFontFaceElement.cpp:
(WebCore::SVGFontFaceElement::unitsPerEm const):

LayoutTests:

Add a test with a 0 unitsperem SVG font.

* svg/text/font-bad-unitsperem-expected.txt: Added.
* svg/text/font-bad-unitsperem.html: Added.
* svg/text/resources/font-bad-unitsperem.svg: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@228715 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog patch | blob | history
LayoutTests/svg/text/font-bad-unitsperem-expected.txt [new file with mode: 0644] patch | blob
LayoutTests/svg/text/font-bad-unitsperem.html [new file with mode: 0644] patch | blob
LayoutTests/svg/text/resources/font-bad-unitsperem.svg [new file with mode: 0644] patch | blob
Source/WebCore/ChangeLog patch | blob | history
Source/WebCore/svg/SVGFontFaceElement.cpp patch | blob | history

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index da3bea3..ec7c29a 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,17 @@
+2018-02-19  Dean Jackson  <dino@apple.com>
+
+        SIGFPE @ int WebCore::SVGToOTFFontConverter::scaleUnitsPerEm<int> const + 45
+        https://bugs.webkit.org/show_bug.cgi?id=182944
+        <rdar://problem/35369984>
+
+        Reviewed by Myles Maxfield.
+
+        Add a test with a 0 unitsperem SVG font.
+
+        * svg/text/font-bad-unitsperem-expected.txt: Added.
+        * svg/text/font-bad-unitsperem.html: Added.
+        * svg/text/resources/font-bad-unitsperem.svg: Added.
+
 2018-02-19  Tim Horton  <timothy_horton@apple.com>
 
         REGRESSION (r219342): Touch event coordinates and elementFromPoint coordinates differ
diff --git a/LayoutTests/svg/text/font-bad-unitsperem-expected.txt b/LayoutTests/svg/text/font-bad-unitsperem-expected.txt
new file mode 100644 (file)
index 0000000..b068058
--- /dev/null
+++ b/LayoutTests/svg/text/font-bad-unitsperem-expected.txt
@@ -0,0 +1 @@
+AAAAAA
diff --git a/LayoutTests/svg/text/font-bad-unitsperem.html b/LayoutTests/svg/text/font-bad-unitsperem.html
new file mode 100644 (file)
index 0000000..f204bab
--- /dev/null
+++ b/LayoutTests/svg/text/font-bad-unitsperem.html
@@ -0,0 +1,12 @@
+<script>
+    if (window.testRunner)
+        window.testRunner.dumpAsText();
+</script>
+<style>
+@font-face {
+    font-family: "foo";
+    src: url("resources/font-bad-unitsperem.svg#foo") format(svg);
+}
+</style>
+<body style="-webkit-font-smoothing: none;">
+<div><span style="font: 50px foo;">AAA</span>AAA</div>
diff --git a/LayoutTests/svg/text/resources/font-bad-unitsperem.svg b/LayoutTests/svg/text/resources/font-bad-unitsperem.svg
new file mode 100644 (file)
index 0000000..8b56f17
--- /dev/null
+++ b/LayoutTests/svg/text/resources/font-bad-unitsperem.svg
@@ -0,0 +1,10 @@
+<?xml version="1.0" standalone="yes"?>
+<svg xmlns="http://www.w3.org/2000/svg">
+    <defs>
+        <font id="foo" horiz-adv-x="1000">
+            <font-face units-per-em="0" ascent="1000" descent="0">
+            </font-face>
+            <glyph unicode="A" horiz-adv-x="1000" d="M 500 0 H 1000 V 600 H 500 z"/>
+        </font>
+    </defs>
+</svg>
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 3016fc8..b29a544 100644 (file)
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,18 @@
+2018-02-19  Dean Jackson  <dino@apple.com>
+
+        SIGFPE @ int WebCore::SVGToOTFFontConverter::scaleUnitsPerEm<int> const + 45
+        https://bugs.webkit.org/show_bug.cgi?id=182944
+        <rdar://problem/35369984>
+
+        Reviewed by Myles Maxfield.
+
+        Avoid a divide-by-zero.
+
+        Test: svg/text/font-bad-unitsperem.html
+
+        * svg/SVGFontFaceElement.cpp:
+        (WebCore::SVGFontFaceElement::unitsPerEm const):
+
 2018-02-19  Tim Horton  <timothy_horton@apple.com>
 
         REGRESSION (r219342): Touch event coordinates and elementFromPoint coordinates differ
diff --git a/Source/WebCore/svg/SVGFontFaceElement.cpp b/Source/WebCore/svg/SVGFontFaceElement.cpp
index 21df8a4..9d2fbb9 100644 (file)
--- a/Source/WebCore/svg/SVGFontFaceElement.cpp
+++ b/Source/WebCore/svg/SVGFontFaceElement.cpp
@@ -88,11 +88,15 @@ void SVGFontFaceElement::parseAttribute(const QualifiedName& name, const AtomicS
 
 unsigned SVGFontFaceElement::unitsPerEm() const
 {
-    const AtomicString& value = attributeWithoutSynchronization(units_per_emAttr);
-    if (value.isEmpty())
+    const AtomicString& valueString = attributeWithoutSynchronization(units_per_emAttr);
+    if (valueString.isEmpty())
+        return FontMetrics::defaultUnitsPerEm;
+
+    auto value = static_cast<unsigned>(ceilf(valueString.toFloat()));
+    if (!value)
         return FontMetrics::defaultUnitsPerEm;
 
-    return static_cast<unsigned>(ceilf(value.toFloat()));
+    return value;
 }
 
 int SVGFontFaceElement::xHeight() const
Mirror of the WebKit open source project from svn.webkit.org.