[Webkit-unassigned] [Bug 20786] New: ASSERT in BitmapImage::draw when an image is scaled and clipped

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=20786

           Summary: ASSERT in BitmapImage::draw when an image is scaled and
                    clipped
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Macintosh
        OS/Version: Mac OS X 10.5
            Status: UNCONFIRMED
          Severity: Normal
          Priority: P2
         Component: Layout and Rendering
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: cmarrin at apple.com
                CC: simon.fraser at apple.com, dino at apple.com


There is an assert at ImageCG.cpp:166 which is wrong and causes the assert to
be hit unnecessarily. Unzip the attached file and open the index.html file.
Then reload over and over again pretty quickly. Sometimes on my machine it can
take 60 reloads to hit the bug. But it will eventually happen.

The problem is that the CGImageCreateWithImageInRect() function calls
CGRectIntegral() to modify the srcRect before creating the image. Then the
ASSERT calls CGImageGetHeight() to get the integral height of the image, but
subtracts srcRect.y() from currHeight (which is also an integral height) to do
the comparison. But srcRect.y() is not an integral position, so the test fails. 

Changing the test to:

    ASSERT(CGImageGetHeight(image) == currHeight -
CGRectIntegral(srcRect).origin.y);

converts srcRect.y() into an integral value and causes the test to succeed. The
attached patch does this.


-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.