[Webkit-unassigned] [Bug 78978] New: SVG assert in SkGeometry::SkChopCubicAt

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=78978

           Summary: SVG assert in SkGeometry::SkChopCubicAt
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: UNCONFIRMED
          Severity: Normal
          Priority: P2
         Component: SVG
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: pdr at google.com
                CC: zimmermann at kde.org


Created an attachment (id=127718)
 --> (https://bugs.webkit.org/attachment.cgi?id=127718&action=review)
Test case

The following will hit an assert in SkChopCubicAt:
<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
<path stroke="#202020" d="M0,0 C0,0 1,1 2190,5130 C2190,5070 2220,5010 2205,4980" />
</svg>

Assert details and backtrace:
[1878:1878:17647143826:FATAL:SkGeometry.cpp(625)] ../../third_party/skia/src/core/SkGeometry.cpp:625: failed assertion "tValues[i] < tValues[i+1]"
Backtrace:
    base::debug::StackTrace::StackTrace() [0x15af9c6]
    logging::LogMessage::~LogMessage() [0x15daabc]
    SkDebugf_FileLine() [0x2e817bf]
    SkChopCubicAt() [0x2ec5137]
    SkChopCubicAtMaxCurvature() [0x2ec5f82]
    SkPathStroker::cubicTo() [0x2e1c3a9]
    SkStroke::strokePath() [0x2e1cb96]
    SkPaint::getFillPath() [0x2de793c]
    WebCore::Path::strokeBoundingRect() [0x318dc2e]
    WebCore::RenderSVGShape::inflateWithStrokeAndMarkerBounds() [0x22a1967]
    WebCore::RenderSVGShape::updateCachedBoundaries() [0x22a1816]
    WebCore::RenderSVGShape::layout() [0x22a0482]
        [ ... snip ... ]

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.