[Webkit-unassigned] [Bug 280986] New: REGRESSION(269351 at main): RELEASE_ASSERT fires when rotating an SVG element around a zero vector

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=280986

            Bug ID: 280986
           Summary: REGRESSION(269351 at main): RELEASE_ASSERT fires when
                    rotating an SVG element around a zero vector
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: SVG
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: sabouhallawa at apple.com
                CC: sabouhallawa at apple.com, zimmermann at kde.org

Created attachment 472842

  --> https://bugs.webkit.org/attachment.cgi?id=472842&action=review

test case

Open the attached test case.

Result: A RELEASE_ASSERT will fire.

This happens because 269351 at main changed LegacyRenderSVGRoot::strokeBoundingBox() to return the value of Markable<FloatRect>. The test case causes the localToParentTransform to be all NaN AffineTransform which causes the strokeBoundingBox to be all also a NaN FloatRect. The problem Markable<FloatRect>::isEmptyValue() returns true if FloatRect::isNaN() is true.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20241007/46b6969a/attachment.htm>