Bug 30313 – NULL ptr in SVGPathSegList::getPathSegAtLength()

• Component: SVG
• Status: RESOLVED FIXED

[Berend-Jan Wever]

Repro:
<SCRIPT>
  SVGPathElement = document.createElementNS("http://www.w3.org/2000/svg", "path");
  SVGPathElement.pathSegList.initialize();
  SVGPathElement.getPathSegAtLength(2699076708.473027);
</SCRIPT>

In the below code, "getItem(i, ec).get();" returns NULL, which is not handled properly, so "segment->pathSegType()" gets called and a NULL ptr read exception is thrown.

unsigned SVGPathSegList::getPathSegAtLength(double)
{
    // FIXME : to be useful this will need to support non-normalized SVGPathSegLists
    ExceptionCode ec = 0;
    int len = numberOfItems();
    // FIXME: Eventually this will likely move to a "path applier"-like model, until then PathTraversalState is less useful as we could just use locals
    PathTraversalState traversalState(PathTraversalState::TraversalSegmentAtLength);
    for (int i = 0; i < len; ++i) {
        SVGPathSeg* segment = getItem(i, ec).get();
        float segmentLength = 0;
        switch (segment->pathSegType()) {
<snip>

[Mark Rowe (bdash)]

<rdar://problem/7297519>

[Oliver Hunt]

Created attachment 44213 [details]
Patch

[WebKit Review Bot]

style-queue ran check-webkit-style on attachment 44213 [details] without any errors.

[Maciej Stachowiak]

Comment on attachment 44213 [details]
Patch

r=me

[Oliver Hunt]

Committed r51627

[Adam Roben (:aroben)]

This caused bug 32117.

[Alexey Proskuryakov]

Looks like this should be marked as resolved. Please reopen and explain if it shouldn't.