Bug 38684 – Incorrect RenderPath object size when large coordinate values encountered

• Component: SVG
• Status: RESOLVED INVALID

[W. James MacLean]

Steps to Reproduce:

Render the attached SVG file (mask-excessive-malloc.svg, from the existing layout tests directory)

Actual output: dumping the render tree gives

layer at (0,0) size 800x600
  RenderView at (0,0) size 800x600
layer at (0,0) size 800x600
  RenderSVGRoot {svg} at (0,0) size 800x600
    RenderSVGResourceMasker {mask} [id="mask"] [maskUnits=objectBoundingBox] [maskContentUnits=userSpaceOnUse]
      RenderPath {rect} at (0,0) size 0x0 [fill={[type=SOLID] [color=#FFFFFF]}] [data="M0.00,0.00 L2147483648.00,0.00 L2147483648.00,2147483648.00 L0.00,2147483648.00 Z"]
    RenderPath {path} at (200,200) size 100x200 [fill={[type=SOLID] [color=#0000FF]}] [data="M200.00,200.00 L300.00,200.00 L300.00,400.00 L200.00,400.00 Z"]
      [masker="mask"] RenderSVGResourceMasker {mask} at (190,180) size 214748364800.00x429496729600.00

Expected output: the render tree should look like (note size of first RenderPath object):


layer at (0,0) size 800x600
  RenderView at (0,0) size 800x600
layer at (0,0) size 800x600
  RenderSVGRoot {svg} at (0,0) size 800x600
    RenderSVGResourceMasker {mask} [id="mask"] [maskUnits=objectBoundingBox] [maskContentUnits=userSpaceOnUse]
      RenderPath {rect} at (0,0) size 800x600 [fill={[type=SOLID] [color=#FFFFFF]}] [data="M0.00,0.00 L2147483648.00,0.00 L2147483648.00,2147483648.00 L0.00,2147483648.00 Z"]
    RenderPath {path} at (200,200) size 100x200 [fill={[type=SOLID] [color=#0000FF]}] [data="M200.00,200.00 L300.00,200.00 L300.00,400.00 L200.00,400.00 Z"]
      [masker="mask"] RenderSVGResourceMasker {mas

Chromium 5.0.395.0 (46220)

Additional information:

The underlying cause appears to be an unsafe float-> int conversion in FloatRect::enclosingIntRect, where static_cast<int> is used on a float outside the range representable by int.

[W. James MacLean]

Created attachment 55290 [details]
SVG File with large coordinate values

[Alexey Proskuryakov]

*** Bug 38680 has been marked as a duplicate of this bug. ***

[Alexey Proskuryakov]

An explanation of why this is wrong from duplicate:

If you modify mask-excessive-malloc.svg so the rect has dimensions in the range
of int, and dump the results render tree, you will find the size of the
RenderPath (line 6) is 800x600, not 0x0. I.e. it clips to the size of the view
port. If you fix the float -> int conversions so that values greater than the
max int 2147483647 are clipped to 2147483647 (which is one reasonable
approach), then the size will be computed as 800x600. The 0x0 size seems to
occur when very large positive floats get erroneously converted to -2147483648,
which gets clipped to 0 for lengths such as height and width.

[Nikolas Zimmermann]

Changed component to SVG, so it shows up in my all-svg-bugs search.

[Dirk Schulze]

We changed that a long time ago and this particular test passes and we actually do have a test for it in the repo.

However, there might be still problems with huge values. Instead you should use viewBox, transform or similar ways to upscale.