Object bounding box wrong for some paths

[Simon Fraser (smfr)]

See https://codepen.io/AmeliaBR/details/dRyPJE/.

Blink bug is https://bugs.chromium.org/p/chromium/issues/detail?id=729067

[Simon Fraser (smfr)]

Created attachment 311881 [details]
Testcase

[Simon Fraser (smfr)]

Created attachment 311884 [details]
Better testcase

[Simon Fraser (smfr)]

RenderSVGShape::calculateObjectBoundingBox() is calling path().fastBoundingRect() which, on macOS, calls CGPathGetBoundingBox(). The comments say:

/* Return the bounding box of `path'. The bounding box is the smallest
   rectangle completely enclosing all points in the path, including control
   points for Bézier cubic and quadratic curves. If the path is empty, then
   return `CGRectNull'. */

We should instead use:

/* Return the path bounding box of `path'. The path bounding box is the
   smallest rectangle completely enclosing all points in the path, *not*
   including control points for Bézier cubic and quadratic curves. If the
   path is empty, then return `CGRectNull'. */

CG_EXTERN CGRect CGPathGetPathBoundingBox(CGPathRef path);

but need to vet all callers of Path::fastBoundingRect().

[Simon Fraser (smfr)]

See also https://trac.webkit.org/changeset/99460/webkit

[Simon Fraser (smfr)]

Created attachment 311965 [details]
Patch

[WebKit Commit Bot]

Comment on attachment 311965 [details]
Patch

Clearing flags on attachment: 311965

Committed r217772: <http://trac.webkit.org/changeset/217772>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.