<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[207274] trunk</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/207274">207274</a></dd>
<dt>Author</dt> <dd>simon.fraser@apple.com</dd>
<dt>Date</dt> <dd>2016-10-12 20:16:15 -0700 (Wed, 12 Oct 2016)</dd>
</dl>
<h3>Log Message</h3>
<pre>Source/WebCore:
Crash when using megaplan.ru
https://bugs.webkit.org/show_bug.cgi?id=163276
rdar://problem/28446672
Reviewed by Sam Weinig.
Make sure we allocate enough space in the vector of CGPoints that we use for path building.
Test: css3/masking/large-clip-path.html
* platform/graphics/cg/PathCG.cpp:
(WebCore::Path::polygonPathFromPoints):
LayoutTests:
polygonPathFromPoints calls uncheckedAppend, but assertion size() < capacity() fails
https://bugs.webkit.org/show_bug.cgi?id=163276
Reviewed by Sam Weinig.
* css3/masking/large-clip-path-expected.txt: Added.
* css3/masking/large-clip-path.html: Added.</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoreplatformgraphicscgPathCGcpp">trunk/Source/WebCore/platform/graphics/cg/PathCG.cpp</a></li>
</ul>
<h3>Added Paths</h3>
<ul>
<li><a href="#trunkLayoutTestscss3maskinglargeclippathexpectedtxt">trunk/LayoutTests/css3/masking/large-clip-path-expected.txt</a></li>
<li><a href="#trunkLayoutTestscss3maskinglargeclippathhtml">trunk/LayoutTests/css3/masking/large-clip-path.html</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (207273 => 207274)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog 2016-10-13 02:38:13 UTC (rev 207273)
+++ trunk/LayoutTests/ChangeLog 2016-10-13 03:16:15 UTC (rev 207274)
</span><span class="lines">@@ -1,3 +1,13 @@
</span><ins>+2016-10-12 Simon Fraser <simon.fraser@apple.com>
+
+ polygonPathFromPoints calls uncheckedAppend, but assertion size() < capacity() fails
+ https://bugs.webkit.org/show_bug.cgi?id=163276
+
+ Reviewed by Sam Weinig.
+
+ * css3/masking/large-clip-path-expected.txt: Added.
+ * css3/masking/large-clip-path.html: Added.
+
</ins><span class="cx"> 2016-10-12 Joseph Pecoraro <pecoraro@apple.com>
</span><span class="cx">
</span><span class="cx"> Web Inspector: step-into `console.log(o)` should not step through inspector javascript
</span></span></pre></div>
<a id="trunkLayoutTestscss3maskinglargeclippathexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/css3/masking/large-clip-path-expected.txt (0 => 207274)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/css3/masking/large-clip-path-expected.txt (rev 0)
+++ trunk/LayoutTests/css3/masking/large-clip-path-expected.txt 2016-10-13 03:16:15 UTC (rev 207274)
</span><span class="lines">@@ -0,0 +1,3 @@
</span><ins>+Test passes if there is no ASSERT in debug.
+
+
</ins></span></pre></div>
<a id="trunkLayoutTestscss3maskinglargeclippathhtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/css3/masking/large-clip-path.html (0 => 207274)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/css3/masking/large-clip-path.html (rev 0)
+++ trunk/LayoutTests/css3/masking/large-clip-path.html 2016-10-13 03:16:15 UTC (rev 207274)
</span><span class="lines">@@ -0,0 +1,22 @@
</span><ins>+<!DOCTYPE html>
+
+<html>
+<head>
+ <style>
+ .box {
+ height: 100px;
+ width: 100px;
+ background-color: silver;
+ -webkit-clip-path: polygon(26px 52px,21.938px 51.959px,18.314px 51.821px,15.105px 51.561px,12.286px 51.157px,9.832px 50.583px,7.72px 49.814px,5.925px 48.827px,4.422px 47.598px,3.187px 46.103px,2.196px 44.317px,1.424px 42.216px,.847px 39.777px,.441px 36.974px,.181px 33.785px,.043px 30.184px,0 26.148px,.039px 22.182px,.173px 18.626px,.426px 15.459px,.824px 12.66px,1.392px 10.207px,2.155px 8.08px,3.137px 6.257px,4.365px 4.716px,5.863px 3.437px,7.655px 2.397px,9.767px 1.575px,12.224px .951px,15.051px .503px,18.273px .209px,21.915px .048px,26px 0,29.939px .057px,33.472px .24px,36.619px .567px,39.4px 1.056px,41.838px 1.725px,43.953px 2.592px,45.765px 3.676px,47.298px 4.994px,48.571px 6.565px,49.607px 8.406px,50.425px 10.536px,51.047px 12.973px,51.494px 15.734px,51.787px 18.838px,51.947px 22.303px,52px 26.148px,51.971px 30.087px,51.865px 33.615px,51.651px 36.754px,51.302px 39.526px,50.788px 41.953px,50.08px 44.056px,49.15px 45.856px,47.969px 47.376px,46.508px 48.636px,4
4.737px 49.657px,42.629px 50.464px,40.152px 51.074px,37.28px 51.512px,33.983px 51.798px,30.233px 51.954px,26px 52px,26px 52px,26px 52px,26px 52px,26px 52px,26px 52px,26px 52px,26px 52px,26px 52px,26px 52px,26px 52px,26px 52px,26px 52px,26px 52px,26px 52px,26px 52px,26px 52px);
+ }
+ </style>
+ <script>
+ if (window.testRunner)
+ testRunner.dumpAsText();
+ </script>
+</head>
+<body>
+<p>Test passes if there is no ASSERT in debug.</p>
+<div class="box"></div>
+</body>
+</html>
</ins></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (207273 => 207274)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog 2016-10-13 02:38:13 UTC (rev 207273)
+++ trunk/Source/WebCore/ChangeLog 2016-10-13 03:16:15 UTC (rev 207274)
</span><span class="lines">@@ -1,3 +1,18 @@
</span><ins>+2016-10-12 Simon Fraser <simon.fraser@apple.com>
+
+ Crash when using megaplan.ru
+ https://bugs.webkit.org/show_bug.cgi?id=163276
+ rdar://problem/28446672
+
+ Reviewed by Sam Weinig.
+
+ Make sure we allocate enough space in the vector of CGPoints that we use for path building.
+
+ Test: css3/masking/large-clip-path.html
+
+ * platform/graphics/cg/PathCG.cpp:
+ (WebCore::Path::polygonPathFromPoints):
+
</ins><span class="cx"> 2016-10-12 Alex Christensen <achristensen@webkit.org>
</span><span class="cx">
</span><span class="cx"> Fix out-of-bounds reading in URLParser when parsing improperly percent-encoded values
</span></span></pre></div>
<a id="trunkSourceWebCoreplatformgraphicscgPathCGcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/platform/graphics/cg/PathCG.cpp (207273 => 207274)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/platform/graphics/cg/PathCG.cpp 2016-10-13 02:38:13 UTC (rev 207273)
+++ trunk/Source/WebCore/platform/graphics/cg/PathCG.cpp 2016-10-13 03:16:15 UTC (rev 207274)
</span><span class="lines">@@ -80,7 +80,7 @@
</span><span class="cx"> return path;
</span><span class="cx">
</span><span class="cx"> Vector<CGPoint, 32> cgPoints;
</span><del>- cgPoints.reserveInitialCapacity(points.size() - 1);
</del><ins>+ cgPoints.reserveInitialCapacity(points.size());
</ins><span class="cx"> for (size_t i = 0; i < points.size(); ++i)
</span><span class="cx"> cgPoints.uncheckedAppend(points[i]);
</span><span class="cx">
</span></span></pre>
</div>
</div>
</body>
</html>