[SCM] WebKit Debian packaging branch, debian/experimental, updated. upstream/1.3.3-9427-gc2be6fc
commit-queue at webkit.org
commit-queue at webkit.org
Wed Dec 22 11:14:53 UTC 2010
The following commit has been merged in the debian/experimental branch:
commit 5cfc07e66629a828881ebd87a9450ff4eeb73058
Author: commit-queue at webkit.org <commit-queue at webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date: Thu Jul 15 23:14:04 2010 +0000
2010-07-15 Alex Nicolaou <anicolao at chromium.org>
Reviewed by Eric Seidel.
Convolution computation causes bad alpha channel values
https://bugs.webkit.org/show_bug.cgi?id=42273
Fixed by clamping colour channel values to the alpha value so that
r <= a, g <= a, and b <= a after the convolution is applied. See
the bug for why I believe the SVG specification needs to be updated.
Test must be drawn to crash. 100x100 green rectangle is used to
indicate pass to minimize the chance of regression.
* platform/mac/svg/custom/convolution-crash-expected.checksum: Added.
* platform/mac/svg/custom/convolution-crash-expected.txt: Added.
* svg/custom/convolution-crash.svg: Added.
2010-07-15 Alex Nicolaou <anicolao at chromium.org>
Reviewed by Eric Seidel.
Convolution computation causes bad alpha channel values
https://bugs.webkit.org/show_bug.cgi?id=42273
Fixed by clamping colour channel values to the alpha value so that
r <= a, g <= a, and b <= a after the convolution is applied. See
the bug for why I believe the SVG specification needs to be updated.
Test must be drawn to crash. 100x100 green rectangle is used to
indicate pass to minimize the chance of regression.
Test: svg/custom/convolution-crash.svg
* platform/graphics/skia/SkiaUtils.cpp:
(WebCore::SkPMColorToColor):
* svg/graphics/filters/SVGFEConvolveMatrix.cpp:
(WebCore::clampRGBAValue):
(WebCore::setDestinationPixels):
(WebCore::FEConvolveMatrix::fastSetInteriorPixels):
(WebCore::FEConvolveMatrix::fastSetOuterPixels):
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@63485 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index a2300ab..425141c 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,20 @@
+2010-07-15 Alex Nicolaou <anicolao at chromium.org>
+
+ Reviewed by Eric Seidel.
+
+ Convolution computation causes bad alpha channel values
+ https://bugs.webkit.org/show_bug.cgi?id=42273
+
+ Fixed by clamping colour channel values to the alpha value so that
+ r <= a, g <= a, and b <= a after the convolution is applied. See
+ the bug for why I believe the SVG specification needs to be updated.
+ Test must be drawn to crash. 100x100 green rectangle is used to
+ indicate pass to minimize the chance of regression.
+
+ * platform/mac/svg/custom/convolution-crash-expected.checksum: Added.
+ * platform/mac/svg/custom/convolution-crash-expected.txt: Added.
+ * svg/custom/convolution-crash.svg: Added.
+
2010-07-15 Dumitru Daniliuc <dumi at chromium.org>
Unreviewed, Chromium-specific changes that I forgot to make in r63278.
diff --git a/LayoutTests/platform/mac/svg/custom/convolution-crash-expected.checksum b/LayoutTests/platform/mac/svg/custom/convolution-crash-expected.checksum
new file mode 100644
index 0000000..109ba6d
--- /dev/null
+++ b/LayoutTests/platform/mac/svg/custom/convolution-crash-expected.checksum
@@ -0,0 +1 @@
+3c785b5908c90246635a1ba12a1f8acf
\ No newline at end of file
diff --git a/LayoutTests/platform/mac/svg/custom/convolution-crash-expected.png b/LayoutTests/platform/mac/svg/custom/convolution-crash-expected.png
new file mode 100644
index 0000000..1197091
Binary files /dev/null and b/LayoutTests/platform/mac/svg/custom/convolution-crash-expected.png differ
diff --git a/LayoutTests/platform/mac/svg/custom/convolution-crash-expected.txt b/LayoutTests/platform/mac/svg/custom/convolution-crash-expected.txt
new file mode 100644
index 0000000..789a578
--- /dev/null
+++ b/LayoutTests/platform/mac/svg/custom/convolution-crash-expected.txt
@@ -0,0 +1,11 @@
+layer at (0,0) size 800x600
+ RenderView at (0,0) size 800x600
+layer at (0,0) size 800x600
+ RenderSVGRoot {svg} at (0,0) size 110x110
+ RenderSVGHiddenContainer {defs} at (0,0) size 0x0
+ RenderSVGResourceFilter {filter} [id="foo"] [filterUnits=objectBoundingBox] [primitiveUnits=userSpaceOnUse]
+ [feConvolveMatrix order="width=3 height=3" kernelMatrix="[0.00, 0.00, 0.00, 0.00, 1.00, 0.00, 0.00, 0.00, -1.00]" divisor="1.00" bias="0.00" target="(1,1)" edgeMode="DUPLICATE" kernelUnitLength="(0,0)" preserveAlpha="0"]
+ [SourceGraphic]
+ RenderSVGImage {image} at (0,0) size 3x4
+ [filter="foo"] RenderSVGResourceFilter {filter} at (-0.20,-0.30) size 2.40x3.60
+ RenderPath {rect} at (10,10) size 100x100 [fill={[type=SOLID] [color=#008000]}] [data="M10.00,10.00 L110.00,10.00 L110.00,110.00 L10.00,110.00 Z"]
diff --git a/LayoutTests/svg/custom/convolution-crash.svg b/LayoutTests/svg/custom/convolution-crash.svg
new file mode 100644
index 0000000..c11ca6e
--- /dev/null
+++ b/LayoutTests/svg/custom/convolution-crash.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+<defs> <filter id="foo"> <feConvolveMatrix kernelMatrix="0 0 0 0 1 0 0 0 -1"/> </filter> </defs>
+<image width="2" height="3" xlink:href="bar" filter="url(#foo)" />
+<rect x="10" y="10" width="100" height="100" fill="green"/>
+</svg>
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index ccee0d9..b7f91fa 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,26 @@
+2010-07-15 Alex Nicolaou <anicolao at chromium.org>
+
+ Reviewed by Eric Seidel.
+
+ Convolution computation causes bad alpha channel values
+ https://bugs.webkit.org/show_bug.cgi?id=42273
+
+ Fixed by clamping colour channel values to the alpha value so that
+ r <= a, g <= a, and b <= a after the convolution is applied. See
+ the bug for why I believe the SVG specification needs to be updated.
+ Test must be drawn to crash. 100x100 green rectangle is used to
+ indicate pass to minimize the chance of regression.
+
+ Test: svg/custom/convolution-crash.svg
+
+ * platform/graphics/skia/SkiaUtils.cpp:
+ (WebCore::SkPMColorToColor):
+ * svg/graphics/filters/SVGFEConvolveMatrix.cpp:
+ (WebCore::clampRGBAValue):
+ (WebCore::setDestinationPixels):
+ (WebCore::FEConvolveMatrix::fastSetInteriorPixels):
+ (WebCore::FEConvolveMatrix::fastSetOuterPixels):
+
2010-07-15 Dumitru Daniliuc <dumi at chromium.org>
Unreviewed, Chromium-specific changes that I forgot to make in r63278.
diff --git a/WebCore/platform/graphics/skia/SkiaUtils.cpp b/WebCore/platform/graphics/skia/SkiaUtils.cpp
index 78cd05a..7473e7a 100644
--- a/WebCore/platform/graphics/skia/SkiaUtils.cpp
+++ b/WebCore/platform/graphics/skia/SkiaUtils.cpp
@@ -82,10 +82,18 @@ static U8CPU InvScaleByte(U8CPU component, uint32_t scale)
SkColor SkPMColorToColor(SkPMColor pm)
{
- if (0 == pm)
+ if (!pm)
return 0;
-
unsigned a = SkGetPackedA32(pm);
+ if (!a) {
+ // A zero alpha value when there are non-zero R, G, or B channels is an
+ // invalid premultiplied color (since all channels should have been
+ // multiplied by 0 if a=0).
+ SkASSERT(false);
+ // In production, return 0 to protect against division by zero.
+ return 0;
+ }
+
uint32_t scale = (255 << 16) / a;
return SkColorSetARGB(a,
diff --git a/WebCore/svg/graphics/filters/SVGFEConvolveMatrix.cpp b/WebCore/svg/graphics/filters/SVGFEConvolveMatrix.cpp
index 39b3e57..616e545 100644
--- a/WebCore/svg/graphics/filters/SVGFEConvolveMatrix.cpp
+++ b/WebCore/svg/graphics/filters/SVGFEConvolveMatrix.cpp
@@ -194,13 +194,37 @@ void FEConvolveMatrix::setPreserveAlpha(bool preserveAlpha)
and would make it really hard to understand.
*/
-static ALWAYS_INLINE unsigned char clampRGBAValue(float rgba)
+static ALWAYS_INLINE unsigned char clampRGBAValue(float channel, unsigned char max = 255)
{
- if (rgba <= 0)
+ if (channel <= 0)
return 0;
- if (rgba >= 255)
- return 255;
- return rgba;
+ if (channel >= max)
+ return max;
+ return channel;
+}
+
+template<bool preserveAlphaValues>
+ALWAYS_INLINE void setDestinationPixels(CanvasPixelArray* image, int& pixel, float* totals, float divisor, float bias, CanvasPixelArray* src)
+{
+ int numTotals = preserveAlphaValues ? 3 : 4;
+ for (int i = 0; i < numTotals; ++i)
+ totals[i] = totals[i] / divisor + bias;
+
+ unsigned char maxAlpha;
+ if (!preserveAlphaValues)
+ maxAlpha = clampRGBAValue(totals[3]);
+ else
+ maxAlpha = 255;
+
+ for (int i = 0; i < 3; ++i)
+ image->set(pixel++, clampRGBAValue(totals[0], maxAlpha));
+
+ if (!preserveAlphaValues)
+ image->set(pixel++, maxAlpha);
+ else {
+ image->set(pixel, src->get(pixel));
+ ++pixel;
+ }
}
// Only for region C
@@ -244,15 +268,7 @@ ALWAYS_INLINE void FEConvolveMatrix::fastSetInteriorPixels(PaintingData& paintin
}
}
- paintingData.dstPixelArray->set(pixel++, clampRGBAValue(totals[0] / m_divisor + paintingData.bias));
- paintingData.dstPixelArray->set(pixel++, clampRGBAValue(totals[1] / m_divisor + paintingData.bias));
- paintingData.dstPixelArray->set(pixel++, clampRGBAValue(totals[2] / m_divisor + paintingData.bias));
- if (!preserveAlphaValues)
- paintingData.dstPixelArray->set(pixel++, clampRGBAValue(totals[3] / m_divisor + paintingData.bias));
- else {
- paintingData.dstPixelArray->set(pixel, paintingData.srcPixelArray->get(pixel));
- ++pixel;
- }
+ setDestinationPixels<preserveAlphaValues>(paintingData.dstPixelArray, pixel, totals, m_divisor, paintingData.bias, paintingData.srcPixelArray);
startKernelPixel += 4;
}
pixel += xIncrease;
@@ -337,15 +353,7 @@ void FEConvolveMatrix::fastSetOuterPixels(PaintingData& paintingData, int x1, in
}
}
- paintingData.dstPixelArray->set(pixel++, clampRGBAValue(totals[0] / m_divisor + paintingData.bias));
- paintingData.dstPixelArray->set(pixel++, clampRGBAValue(totals[1] / m_divisor + paintingData.bias));
- paintingData.dstPixelArray->set(pixel++, clampRGBAValue(totals[2] / m_divisor + paintingData.bias));
- if (!preserveAlphaValues)
- paintingData.dstPixelArray->set(pixel++, clampRGBAValue(totals[3] / m_divisor + paintingData.bias));
- else {
- paintingData.dstPixelArray->set(pixel, paintingData.srcPixelArray->get(pixel));
- ++pixel;
- }
+ setDestinationPixels<preserveAlphaValues>(paintingData.dstPixelArray, pixel, totals, m_divisor, paintingData.bias, paintingData.srcPixelArray);
++startKernelPixelX;
}
pixel += xIncrease;
--
WebKit Debian packaging
More information about the Pkg-webkit-commits
mailing list