[Webkit-unassigned] [Bug 26470] New: [Cairo] Zero-height image pattern Causes Crash

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=26470

           Summary: [Cairo] Zero-height image pattern Causes Crash
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Macintosh
        OS/Version: Mac OS X 10.5
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: WebKit Misc.
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: bfulgham at webkit.org


The Windows Cairo build of WebKit will crash when running the LayoutTest
"fast/gradients/border-image-gradient-sides-and-corners.html".

The failure occurs down inside cairo, but is triggered by a NaN value generated
in Image::drawTiled (see Image.cpp line 170):

vPhase -= fmodf(dstRect.height(), scale.height() * srcRect.height() / 2.0f);

The fmodf (at least under Windows) generates a silent NaN, yielding a vPhase of
-1.0#IND00.  Later, this triggers a divide-by-zero deep in the cairo logic.

This same test works properly under Safari.


-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.