Bug 201117 – Page crashes under CGPathAddUnevenCornersRoundedRect

• Component: Layout and Rendering
• Status: RESOLVED FIXED

[Simon Fraser (smfr)]

https://onehtmlpagechallenge.com/entries/pure-css-still-life-water-lemon.html crashes:

Application Specific Information:
Assertion failed: (corners[1].height + corners[2].height <= rect.size.height), function assert_uneven_corners_are_valid, file /BuildRoot/Library/Caches/com.apple.xbs/Sources/CoreGraphics/CoreGraphics-1245.8.4.8/CoreGraphics/Paths/CGPath.cc, line 50.

[Radar WebKit Bug Importer]

<rdar://problem/54671796>

[Simon Fraser (smfr)]

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   libsystem_kernel.dylib        	0x00007fff7dea5b86 __pthread_kill + 10
1   libsystem_pthread.dylib       	0x00007fff7df5bc50 pthread_kill + 285
2   libsystem_c.dylib             	0x00007fff7de0f1c9 abort + 127
3   libsystem_c.dylib             	0x00007fff7ddd7868 __assert_rtn + 320
4   com.apple.CoreGraphics        	0x00007fff5133b10e (anonymous namespace)::assert_uneven_corners_are_valid(CGRect const&, CGSize const*) + 216
5   com.apple.CoreGraphics        	0x00007fff5133b43c CGPathAddUnevenCornersRoundedRect + 152
6   com.apple.WebCore             	0x0000000388085b46 WebCore::Path::platformAddPathForRoundedRect(WebCore::FloatRect const&, WebCore::FloatSize const&, WebCore::FloatSize const&, WebCore::FloatSize const&, WebCore::FloatSize const&) + 294
7   com.apple.WebCore             	0x00000003894993f6 WebCore::GraphicsContext::clipRoundedRect(WebCore::FloatRoundedRect const&) + 54
8   com.apple.WebCore             	0x0000000389610573 WebCore::RenderBoxModelObject::paintBoxShadow(WebCore::PaintInfo const&, WebCore::LayoutRect const&, WebCore::RenderStyle const&, WebCore::ShadowStyle, bool, bool) + 3907
9   com.apple.WebCore             	0x00000003880603fe WebCore::RenderBox::paintBoxDecorations(WebCore::PaintInfo&, WebCore::LayoutPoint const&) + 1134
10  com.apple.WebCore             	0x000000038805d9ae WebCore::RenderBlock::paintObject(WebCore::PaintInfo&, WebCore::LayoutPoint const&) + 78

[Simon Fraser (smfr)]

(lldb) p r
(const WebCore::FloatRoundedRect) $0 = {
  m_rect = { x = 0.5, y = 0.0, width = 132.0, height = 106.0 }
  m_radii = (m_topLeft = { width = 65.9921875, height = 56.4948502 }, m_topRight = { width = 65.9921875, height = 56.4948502 }, m_bottomLeft = { width = 65.9921875, height = 49.5051537 }, m_bottomRight = { width = 65.9921875, height = 49.5051537 })
}
(lldb) p rect
(const WebCore::FloatRect) $1 = { x = 0.5, y = 0.0, width = 132.0, height = 106.0 }

[Simon Fraser (smfr)]

Created attachment 377213 [details]
Patch

[WebKit Commit Bot]

Comment on attachment 377213 [details]
Patch

Clearing flags on attachment: 377213

Committed r249090: <https://trac.webkit.org/changeset/249090>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.