[Webkit-unassigned] [Bug 185608] iOS 11.3 WebKit crash

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=185608

--- Comment #1 from Tomas Slavkovsky <tomas.slavkovsky at windy.com> ---
We found where it fails. It is on entry into the imageData field. Everytime it fails on a different place. Image has size 500x2000px.

Here is the code:

var w = nx * sx
            , imageData = ctx.createImageData( w, h )
            , data = imageData.data

            var p = 0
            , len = ( data.length - 4 ) // last item

            for( j = 0; j < h; j++ ) {

                if(p >= len) break

                for( i = 0; i < w; i++ ) {

                    if(p >= len) break

                    o = j * w + i

                    var br = 1.0

                    if( (j > 0) && (j < (h - 1)) && (i > 0) && (i < w - 1) ) {
                        br = this.edge( dst, w, o )
                    }

                    var rgb = this.steps_[ dst[o] ] || [0, 0, 0]

                    if( br < 0.99 ) {
                        data[p++] = Math.round(rgb[0] * br)
                        data[p++] = Math.round(rgb[1] * br)
                        data[p++] = Math.round(rgb[2] * br)
                    }
                    else if( br > 2.0 ) {
                        data[p++] = Math.min(rgb[0] + br, 255)
                        data[p++] = Math.min(rgb[1] + br, 255)
                        data[p++] = Math.min(rgb[2] + br, 255)
                    }
                    else {
                        data[p++] = rgb[0]
                        data[p++] = rgb[1]
                        data[p++] = rgb[2]
                    }
                    data[p++] = 255;

                }

            }

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20180515/1aec6f46/attachment.html>