6890 2006-01-28 09:33:58 -0800 SVG - invalid polyline data causes hang 2006-03-06 15:08:30 -0800 1 1 1 Unclassified WebKit SVG 420+ Mac OS X 10.4 RESOLVED FIXED SVGHitList P1 Normal --- 6951 1 mark a ap oldest_to_newest 30413 0 mark 2006-01-28 09:33:58 -0800 The attached SVG will cause WebKit (lastest nightly ~1/27/2006) to hang indefinitely. It has invalid polyline data (INF as one of the coordinates). Firefox and Adobe/IE report the problem, but WebKit goes to pinwheel. WARNING: Viewing this actually causes the entire computer to hang, and had to manually power off (perhaps another issue for apple?), so I wouldn't view it outside a debugger. 30414 1 6051 mark 2006-01-28 09:36:46 -0800 Created attachment 6051 sample svg with invalid polyline data 30417 2 eric 2006-01-28 13:12:02 -0800 Reproducible crasher = SVG HitList. Addign Keyword. This shoudl be simple to fix. 32038 3 darin 2006-02-10 09:31:53 -0800 Reproducible crashers, even in SVG, are P1. 32326 4 6463 a 2006-02-13 12:21:53 -0800 Created attachment 6463 testcases for 6890 and 6951 32327 5 6464 a 2006-02-13 12:22:28 -0800 Created attachment 6464 fix 32457 6 6464 eric 2006-02-14 03:21:27 -0800 Comment on attachment 6464 fix A couple comments: 1. I think it's better to declare optr on its own line. (make the declaration less confusing). 2. I think optr deserves a better name. Honestly, I think ptr deserves a better name... The code is hard enough to read as is... giving the variables cryptic names only hurts :( 3. While you're in there, you might as well remove the commented out //std::cout lines. Three little nits, if you were landing your own patches you could just fix them as you landed, but since someone else has to land this, I think it's best to get one more round of patches. 32458 7 6463 eric 2006-02-14 03:24:34 -0800 Comment on attachment 6463 testcases for 6890 and 6951 These are fine. Ideally we would remove more of the extra junk when reducing, such as: xmlns:my="http://mark.vakoc.com/" xmlns:fn="http://www.w3.org/2005/02/xpath-functions", etc. Also no need to have svg:polyline, just polyline The second test is another example. You could remove the <![CDATA[ block as well as the xlink namespace. the tests look fine otherwise. Whoever lands these will have to actually generate the final expected results. 32566 8 6463 eric 2006-02-15 01:44:27 -0800 Comment on attachment 6463 testcases for 6890 and 6951 Removing review flag from test cases. They're fine to land. Waiting still for revised patch. 34901 9 6815 a 2006-03-02 16:09:41 -0800 Created attachment 6815 cleaned version of the method 34937 10 6815 eric 2006-03-03 01:24:16 -0800 Comment on attachment 6815 cleaned version of the method svgPolyTo(xPos, xPos, segmentNum++); looks wrong. It should be svgPolyTo(xPos, yPos, segmentNum++); I think. Otherwise this looks fine. Please be sure to add the layout tests, results, and change log when landing. With that fixed, this is good to land. r=me. 35294 11 6815 darin 2006-03-06 09:11:38 -0800 Comment on attachment 6815 cleaned version of the method This code looks to me like it can look at a character past the end of the string. Where's the check that currSegment < eoString before looking at *currSegment? 35333 12 darin 2006-03-06 15:08:30 -0800 Alex landed this change already. 6051 2006-01-28 09:36:46 -0800 2006-01-28 09:36:46 -0800 sample svg with invalid polyline data test.svg image/svg+xml 393 mark PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz4KPHN2ZyB4bWxuczpteT0iaHR0 cDovL21hcmsudmFrb2MuY29tLyIgeG1sbnM6c3ZnPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2 ZyIKICAgICB4bWxuczpmbj0iaHR0cDovL3d3dy53My5vcmcvMjAwNS8wMi94cGF0aC1mdW5jdGlv bnMiCiAgICAgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIgogICAgIHdpZHRoPSIx MzAwIgogICAgIGhlaWdodD0iMTMwMCI+CiAgIAogICAgICAgICA8c3ZnOnBvbHlsaW5lIGZpbGw9 Im5vbmUiIHN0cm9rZT0icmVkIiBzdHJva2Utd2lkdGg9IjIiCiAgICAgICAgICAgICAgICAgICAg ICAgcG9pbnRzPSI0Miw2MDAgNDIuNjc1NzA3NzAxNTg0Njg1LElORiAiLz4KPC9zdmc+ 6463 2006-02-13 12:21:53 -0800 2006-02-15 01:44:27 -0800 testcases for 6890 and 6951 invalid-poly-tests.patch text/plain 2279 a SW5kZXg6IHN2Zy9jdXN0b20vcG9seWxpbmUtaW52YWxpZC1wb2ludHMuc3ZnCj09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0K LS0tIHN2Zy9jdXN0b20vcG9seWxpbmUtaW52YWxpZC1wb2ludHMuc3ZnCShyZXZpc2lvbiAwKQor Kysgc3ZnL2N1c3RvbS9wb2x5bGluZS1pbnZhbGlkLXBvaW50cy5zdmcJKHJldmlzaW9uIDApCkBA IC0wLDAgKzEsNyBAQAorPD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz4KKzxz dmcgeG1sbnM6bXk9Imh0dHA6Ly9tYXJrLnZha29jLmNvbS8iIHhtbG5zOnN2Zz0iaHR0cDovL3d3 dy53My5vcmcvMjAwMC9zdmciCisgICAgIHhtbG5zOmZuPSJodHRwOi8vd3d3LnczLm9yZy8yMDA1 LzAyL3hwYXRoLWZ1bmN0aW9ucyIKKyAgICAgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAv c3ZnIj4KKyAgICA8cmVjdCB4PSIwIiB5PSIwIiB3aWR0aD0iMTAwIiBoZWlnaHQ9IjEwMCIgZmls bD0icmVkIi8+CisgICAgPHN2Zzpwb2x5bGluZSBmaWxsPSJub25lIiBzdHJva2U9ImdyZWVuIiBz dHJva2Utd2lkdGg9IjEwMCIgcG9pbnRzPSI1MCwwIDUwLCAxMDAsSU5GIElORiIvPgorPC9zdmc+ CkluZGV4OiBzdmcvY3VzdG9tL3BvbHlsaW5lLXNldGF0dHJpYnV0ZS1wb2ludHMtbnVsbC5zdmcK PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PQotLS0gc3ZnL2N1c3RvbS9wb2x5bGluZS1zZXRhdHRyaWJ1dGUtcG9pbnRzLW51 bGwuc3ZnCShyZXZpc2lvbiAwKQorKysgc3ZnL2N1c3RvbS9wb2x5bGluZS1zZXRhdHRyaWJ1dGUt cG9pbnRzLW51bGwuc3ZnCShyZXZpc2lvbiAwKQpAQCAtMCwwICsxLDI2IEBACis8P3htbCB2ZXJz aW9uPSIxLjAiIGVuY29kaW5nPSJVVEYtOCI/PgorPHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5v cmcvMjAwMC9zdmciCisgeG1sbnM6eGxpbms9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkveGxpbmsi Cisgb25sb2FkPSJpbml0KCkiPgorCis8c2NyaXB0PgorCTwhW0NEQVRBWworCQl2YXIgc3ZnbnMg PSAiaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciOworCQl2YXIgZDsKKwkJCisgICAgICBmdW5j dGlvbiBpbml0KCkKKyAgICAgIHsKKwkJCXZhciBwb2x5bGluZSA9IGRvY3VtZW50LmNyZWF0ZUVs ZW1lbnROUyhzdmducywgInBvbHlsaW5lIik7CisJCQlwb2x5bGluZS5zZXRBdHRyaWJ1dGUoInBv aW50cyIsIGQpOworCQkJdmFyIGcgPSBkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgiY29udGFpbmVy Iik7CisJCQlnLmFwcGVuZENoaWxkKHBvbHlsaW5lKTsKKyAgICAgICAgIC8vIHZlcmlmeSB0aGF0 IHRoZSBzY3JpcHQgYXJyaXZlZCBoZXJlIHdpdGhvdXQgZXJyb3IgYnkgZmlsbGluZyB0aGUgcmVj dGFuZ2xlIHdpdGggZ3JlZW4KKyAgICAgICAgIGRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCJwYXNz ZWQiKS5zZXRBdHRyaWJ1dGUoImZpbGwiLCAiZ3JlZW4iKTsKKwkJfQorCV1dPgorPC9zY3JpcHQ+ CisgCisgPHJlY3QgaWQ9InBhc3NlZCIgeD0iMCIgeT0iMCIgd2lkdGg9IjEwMCIgaGVpZ2h0PSIx MDAiIGZpbGw9InJlZCIvPgorIDxnIGlkPSJjb250YWluZXIiPjwvZz4KKworPC9zdmc+CkluZGV4 OiBDaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PQotLS0gQ2hhbmdlTG9nCShyZXZpc2lvbiAxMjc3MCkKKysr IENoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE0IEBACisyMDA2LTAyLTEzICBB bGV4YW5kZXIgS2VsbGV0dCAgPGx5cGFub3ZAa2RlLm9yZz4KKworICAgICAgICBSZXZpZXdlZCBi eSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICAtIG5ldyByZWR1Y2VkIHRlc3RjYXNlcyBmb3I6 CisgICAgICAgICAgaHR0cDovL2J1Z3ppbGxhLm9wZW5kYXJ3aW4ub3JnL3Nob3dfYnVnLmNnaT9p ZD02OTUxCisgICAgICAgICAgaHR0cDovL2J1Z3ppbGxhLm9wZW5kYXJ3aW4ub3JnL3Nob3dfYnVn LmNnaT9pZD02ODkwICAKKworICAgICAgICAqIHN2Zy9jdXN0b20vcG9seWxpbmUtaW52YWxpZC1w b2ludHMuc3ZnOiBBZGRlZC4KKyAgICAgICAgKiBzdmcvY3VzdG9tL3BvbHlsaW5lLXNldGF0dHJp YnV0ZS1wb2ludHMtbnVsbC5zdmc6IEFkZGVkLgorCiAyMDA2LTAyLTExICBBbGV4YW5kZXIgS2Vs bGV0dCAgPGx5cGFub3ZAa2RlLm9yZz4KIAogICAgICAgICBBZGRpbmcgdGVzdCBjYXNlIGZvcgo= 6464 2006-02-13 12:22:28 -0800 2006-03-02 16:09:41 -0800 fix invalid-poly.patch text/plain 2145 a SW5kZXg6IENoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBDaGFuZ2VMb2cJKHJldmlzaW9uIDEyNzcy KQorKysgQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTggQEAKKzIwMDYtMDIt MTMgIEFsZXhhbmRlciBLZWxsZXR0ICA8bHlwYW5vdkBrZGUub3JnPgorCisgICAgICAgIFJldmll d2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIC0gZml4IGh0dHA6Ly9idWd6aWxsYS5v cGVuZGFyd2luLm9yZy9zaG93X2J1Zy5jZ2k/aWQ9Njg5MAorICAgICAgICAgIGFuZCBodHRwOi8v YnVnemlsbGEub3BlbmRhcndpbi5vcmcvc2hvd19idWcuY2dpP2lkPTY5NTEKKyAgICAgICAgICBi eSBiZWluZyBtb3JlIHRvbGVyYW50IHRvd2FyZHMgaW52YWxpZCBwb2ludHMgZGF0YQorCisgICAg ICAgIC0gbmV3IHRlc3RzOgorICAgICAgICAgIHN2Zy9jdXN0b20vcG9seWxpbmUtc2V0YXR0cmli dXRlLXBvaW50cy1udWxsLnN2ZworICAgICAgICAgIHN2Zy9jdXN0b20vcG9seWxpbmUtaW52YWxp ZC1wb2ludHMuc3ZnCisKKyAgICAgICAgKiBrc3ZnMi9zdmcvc3ZncGF0aHBhcnNlci5jcHA6Cisg ICAgICAgIChTVkdQb2x5UGFyc2VyOjpwYXJzZVBvaW50cyk6CisKIDIwMDYtMDItMTIgIE1hY2ll aiBTdGFjaG93aWFrICA8bWpzQGFwcGxlLmNvbT4KIAogICAgICAgICBVbnJldmlld2VkIGJ1aWxk IGZpeC4KSW5kZXg6IGtzdmcyL3N2Zy9zdmdwYXRocGFyc2VyLmNwcAo9PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBr c3ZnMi9zdmcvc3ZncGF0aHBhcnNlci5jcHAJKHJldmlzaW9uIDEyNzY0KQorKysga3N2ZzIvc3Zn L3N2Z3BhdGhwYXJzZXIuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC05Nyw3ICs5Nyw3IEBAIFNWR1Bv bHlQYXJzZXI6OnBhcnNlUG9pbnRzKCBjb25zdCBRU3RyaW4KICAgICAgICAgUVN0cmluZyBwb2lu dHMgPSBzOwogICAgICAgICBwb2ludHMgPSBwb2ludHMucmVwbGFjZSgnLCcsICcgJyk7CiAgICAg ICAgIHBvaW50cyA9IHBvaW50cy5zaW1wbGlmeVdoaXRlU3BhY2UoKTsKLSAgICAgICAgY29uc3Qg Y2hhciAqcHRyID0gcG9pbnRzLmxhdGluMSgpOworICAgICAgICBjb25zdCBjaGFyKiBwdHIgPSBw b2ludHMubGF0aW4xKCksICpvcHRyOwogICAgICAgICBjb25zdCBjaGFyICplbmQgPSBwb2ludHMu bGF0aW4xKCkgKyBwb2ludHMubGVuZ3RoKCk7CiAKICAgICAgICAgZG91YmxlIGN1cnggPSAwLCBj dXJ5ID0gMDsKQEAgLTEwNiwxMiArMTA2LDE4IEBAIFNWR1BvbHlQYXJzZXI6OnBhcnNlUG9pbnRz KCBjb25zdCBRU3RyaW4KICAgICAgICAgewogICAgICAgICAgICAgLy9zdGQ6OmNvdXQgPDwgInB0 ciA6ICIgPDwgcHRyIDw8IHN0ZDo6ZW5kbDsKICAgICAgICAgICAgIC8vc3RkOjpjb3V0IDw8ICJl bmQgOiAiIDw8IGVuZCA8PCBzdGQ6OmVuZGw7Ci0gICAgICAgICAgICBwdHIgPSBwYXJzZUNvb3Jk KCBwdHIsIGN1cnggKTsKLSAgICAgICAgICAgIGlmKCAqcHRyID09ICcsJyB8fCAqcHRyID09ICcg JyApCisgICAgICAgICAgICBvcHRyID0gcHRyOworICAgICAgICAgICAgcHRyID0gcGFyc2VDb29y ZChwdHIsIGN1cngpOyAKKyAgICAgICAgICAgIGlmIChwdHIgPT0gb3B0cikKKyAgICAgICAgICAg ICAgICBicmVhazsKKyAgICAgICAgICAgIGlmICgqcHRyID09ICcsJyB8fCAqcHRyID09ICcgJykK ICAgICAgICAgICAgICAgICBwdHIrKzsKLSAgICAgICAgICAgIHB0ciA9IHBhcnNlQ29vcmQoIHB0 ciwgY3VyeSApOwotICAgICAgICAgICAgc3ZnUG9seVRvKCBjdXJ4LCBjdXJ5LCBucisrICk7Ci0g ICAgICAgICAgICBpZiggKnB0ciA9PSAnICcgKQorICAgICAgICAgICAgb3B0ciA9IHB0cjsKKyAg ICAgICAgICAgIHB0ciA9IHBhcnNlQ29vcmQocHRyLCBjdXJ5KTsKKyAgICAgICAgICAgIGlmIChw dHIgPT0gb3B0cikKKyAgICAgICAgICAgICAgICBicmVhazsKKyAgICAgICAgICAgIHN2Z1BvbHlU byhjdXJ4LCBjdXJ5LCBucisrKTsKKyAgICAgICAgICAgIGlmICgqcHRyID09ICcgJykKICAgICAg ICAgICAgICAgICBwdHIrKzsKICAgICAgICAgfQogICAgIH0K 6815 2006-03-02 16:09:41 -0800 2006-03-03 01:24:16 -0800 cleaned version of the method invalid-poly-2.patch text/plain 2176 a SW5kZXg6IGtzdmcyL3N2Zy9zdmdwYXRocGFyc2VyLmNwcAo9PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBrc3ZnMi9z dmcvc3ZncGF0aHBhcnNlci5jcHAJKHJldmlzaW9uIDEzMDczKQorKysga3N2ZzIvc3ZnL3N2Z3Bh dGhwYXJzZXIuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC04OSwzMCArODksMzUgQEAgY29uc3QgY2hh ciAqS1NWRzo6cGFyc2VDb29yZChjb25zdCBjaGFyIAogICAgIHJldHVybiBwdHI7CiB9CiAKLXZv aWQKLVNWR1BvbHlQYXJzZXI6OnBhcnNlUG9pbnRzKCBjb25zdCBRU3RyaW5nICZzICkgY29uc3QK K3ZvaWQgU1ZHUG9seVBhcnNlcjo6cGFyc2VQb2ludHMoY29uc3QgUVN0cmluZyAmcykgY29uc3QK IHsKLSAgICBpZighcy5pc0VtcHR5KCkpCi0gICAgewotICAgICAgICBRU3RyaW5nIHBvaW50cyA9 IHM7Ci0gICAgICAgIHBvaW50cyA9IHBvaW50cy5yZXBsYWNlKCcsJywgJyAnKTsKLSAgICAgICAg cG9pbnRzID0gcG9pbnRzLnNpbXBsaWZ5V2hpdGVTcGFjZSgpOwotICAgICAgICBjb25zdCBjaGFy ICpwdHIgPSBwb2ludHMubGF0aW4xKCk7Ci0gICAgICAgIGNvbnN0IGNoYXIgKmVuZCA9IHBvaW50 cy5sYXRpbjEoKSArIHBvaW50cy5sZW5ndGgoKTsKLQotICAgICAgICBkb3VibGUgY3VyeCA9IDAs IGN1cnkgPSAwOwotICAgICAgICBpbnQgbnIgPSAwOwotICAgICAgICB3aGlsZSggcHRyIDwgZW5k ICkKLSAgICAgICAgewotICAgICAgICAgICAgLy9zdGQ6OmNvdXQgPDwgInB0ciA6ICIgPDwgcHRy IDw8IHN0ZDo6ZW5kbDsKLSAgICAgICAgICAgIC8vc3RkOjpjb3V0IDw8ICJlbmQgOiAiIDw8IGVu ZCA8PCBzdGQ6OmVuZGw7Ci0gICAgICAgICAgICBwdHIgPSBwYXJzZUNvb3JkKCBwdHIsIGN1cngg KTsKLSAgICAgICAgICAgIGlmKCAqcHRyID09ICcsJyB8fCAqcHRyID09ICcgJyApCi0gICAgICAg ICAgICAgICAgcHRyKys7Ci0gICAgICAgICAgICBwdHIgPSBwYXJzZUNvb3JkKCBwdHIsIGN1cnkg KTsKLSAgICAgICAgICAgIHN2Z1BvbHlUbyggY3VyeCwgY3VyeSwgbnIrKyApOwotICAgICAgICAg ICAgaWYoICpwdHIgPT0gJyAnICkKLSAgICAgICAgICAgICAgICBwdHIrKzsKKyAgICBpZiAoIXMu aXNFbXB0eSgpKSB7CisgICAgICAgIFFTdHJpbmcgcG9pbnREYXRhID0gczsKKyAgICAgICAgcG9p bnREYXRhID0gcG9pbnREYXRhLnJlcGxhY2UoJywnLCAnICcpOworICAgICAgICBwb2ludERhdGEg PSBwb2ludERhdGEuc2ltcGxpZnlXaGl0ZVNwYWNlKCk7CisgICAgICAgIGNvbnN0IGNoYXIqIGN1 cnJTZWdtZW50ID0gcG9pbnREYXRhLmxhdGluMSgpOworICAgICAgICBjb25zdCBjaGFyKiBlb1N0 cmluZyA9IHBvaW50RGF0YS5sYXRpbjEoKSArIHBvaW50RGF0YS5sZW5ndGgoKTsKKyAgICAgICAg CisgICAgICAgIGludCBzZWdtZW50TnVtID0gMDsKKyAgICAgICAgd2hpbGUgKGN1cnJTZWdtZW50 IDwgZW9TdHJpbmcpIHsKKyAgICAgICAgICAgIGNvbnN0IGNoYXIqIHByZXZTZWdtZW50ID0gY3Vy clNlZ21lbnQ7CisgICAgICAgICAgICBkb3VibGUgeFBvcyA9IDA7CisgICAgICAgICAgICBjdXJy U2VnbWVudCA9IHBhcnNlQ29vcmQoY3VyclNlZ21lbnQsIHhQb3MpOyAKKyAgICAgICAgICAgIGlm IChjdXJyU2VnbWVudCA9PSBwcmV2U2VnbWVudCkKKyAgICAgICAgICAgICAgICBicmVhazsKKyAg ICAgICAgICAgICAgICAKKyAgICAgICAgICAgIGlmICgqY3VyclNlZ21lbnQgPT0gJywnIHx8ICpj dXJyU2VnbWVudCA9PSAnICcpCisgICAgICAgICAgICAgICAgY3VyclNlZ21lbnQrKzsKKworICAg ICAgICAgICAgcHJldlNlZ21lbnQgPSBjdXJyU2VnbWVudDsKKyAgICAgICAgICAgIGRvdWJsZSB5 UG9zID0gMDsKKyAgICAgICAgICAgIGN1cnJTZWdtZW50ID0gcGFyc2VDb29yZChjdXJyU2VnbWVu dCwgeVBvcyk7CisgICAgICAgICAgICBpZiAoY3VyclNlZ21lbnQgPT0gcHJldlNlZ21lbnQpCisg ICAgICAgICAgICAgICAgYnJlYWs7CisgICAgICAgICAgICAgICAgCisgICAgICAgICAgICBzdmdQ b2x5VG8oeFBvcywgeFBvcywgc2VnbWVudE51bSsrKTsKKyAgICAgICAgICAgIGlmICgqY3VyclNl Z21lbnQgPT0gJyAnKQorICAgICAgICAgICAgICAgIGN1cnJTZWdtZW50Kys7CiAgICAgICAgIH0K ICAgICB9CiB9Cg==