diff --git a/dom/canvas/CanvasRenderingContext2D.cpp b/dom/canvas/CanvasRenderingContext2D.cpp
index deae6feab0..e6fc9363bf 100644
--- a/dom/canvas/CanvasRenderingContext2D.cpp
+++ b/dom/canvas/CanvasRenderingContext2D.cpp
@@ -3833,6 +3833,10 @@ CanvasRenderingContext2D::DrawOrMeasureText(const nsAString& aRawText,
return NS_OK;
}
+ if (!IsFinite(aX) || !IsFinite(aY)) {
+ return NS_OK;
+ }
+
const ContextState &state = CurrentState();
// This is only needed to know if we can know the drawing bounding box easily.
diff --git a/dom/canvas/crashtests/1229932-1.html b/dom/canvas/crashtests/1229932-1.html
new file mode 100644
index 0000000000..b5f06ff85c
--- /dev/null
+++ b/dom/canvas/crashtests/1229932-1.html
@@ -0,0 +1,16 @@
+
+
+
+
+
+
+
+
diff --git a/dom/canvas/crashtests/1229983-1.html b/dom/canvas/crashtests/1229983-1.html
new file mode 100644
index 0000000000..a865c569e4
--- /dev/null
+++ b/dom/canvas/crashtests/1229983-1.html
@@ -0,0 +1,24 @@
+
+
+
+
+
+
+
+
diff --git a/dom/canvas/crashtests/1233613.html b/dom/canvas/crashtests/1233613.html
new file mode 100644
index 0000000000..d949c3b21c
--- /dev/null
+++ b/dom/canvas/crashtests/1233613.html
@@ -0,0 +1,19 @@
+
+
diff --git a/dom/canvas/crashtests/crashtests.list b/dom/canvas/crashtests/crashtests.list
index a8dcd51fa8..4f2323f387 100644
--- a/dom/canvas/crashtests/crashtests.list
+++ b/dom/canvas/crashtests/crashtests.list
@@ -25,4 +25,7 @@ load 1183363.html
load 1190705.html
load 1223740-1.html
load 1225381-1.html
+skip-if(azureCairo) load 1229983-1.html
+load 1229932-1.html
+load 1233613.html
load texImage2D.html
diff --git a/dom/webidl/CSS.webidl b/dom/webidl/CSS.webidl
index 9965554a88..b5cdab2d18 100644
--- a/dom/webidl/CSS.webidl
+++ b/dom/webidl/CSS.webidl
@@ -20,6 +20,5 @@ interface CSS {
// http://dev.w3.org/csswg/cssom/#the-css.escape%28%29-method
partial interface CSS {
- [Throws]
static DOMString escape(DOMString ident);
};
diff --git a/gfx/2d/DrawTargetSkia.cpp b/gfx/2d/DrawTargetSkia.cpp
index 933f72f76d..1ba1360242 100644
--- a/gfx/2d/DrawTargetSkia.cpp
+++ b/gfx/2d/DrawTargetSkia.cpp
@@ -482,6 +482,10 @@ DrawTargetSkia::Stroke(const Path *aPath,
return;
}
+ if (!skiaPath->GetPath().isFinite()) {
+ return;
+ }
+
mCanvas->drawPath(skiaPath->GetPath(), paint.mPaint);
}
@@ -532,6 +536,10 @@ DrawTargetSkia::Fill(const Path *aPath,
AutoPaintSetup paint(mCanvas.get(), aOptions, aPattern);
+ if (!skiaPath->GetPath().isFinite()) {
+ return;
+ }
+
mCanvas->drawPath(skiaPath->GetPath(), paint.mPaint);
}
diff --git a/gfx/2d/PathSkia.cpp b/gfx/2d/PathSkia.cpp
index dc3980bbf4..3726439b66 100644
--- a/gfx/2d/PathSkia.cpp
+++ b/gfx/2d/PathSkia.cpp
@@ -201,6 +201,10 @@ PathSkia::StrokeContainsPoint(const StrokeOptions &aStrokeOptions,
Rect
PathSkia::GetBounds(const Matrix &aTransform) const
{
+ if (!mPath.isFinite()) {
+ return Rect();
+ }
+
Rect bounds = SkRectToRect(mPath.getBounds());
return aTransform.TransformBounds(bounds);
}
@@ -209,6 +213,10 @@ Rect
PathSkia::GetStrokedBounds(const StrokeOptions &aStrokeOptions,
const Matrix &aTransform) const
{
+ if (!mPath.isFinite()) {
+ return Rect();
+ }
+
SkPaint paint;
StrokeOptionsToPaint(paint, aStrokeOptions);
diff --git a/layout/base/nsCSSRendering.cpp b/layout/base/nsCSSRendering.cpp
index dc86fbd602..a7f101d00d 100644
--- a/layout/base/nsCSSRendering.cpp
+++ b/layout/base/nsCSSRendering.cpp
@@ -5524,7 +5524,7 @@ nsContextBoxBlur::Init(const nsRect& aRect, nscoord aSpreadRadius,
IntSize blurRadius;
IntSize spreadRadius;
- GetBlurAndSpreadRadius(aDestinationCtx, aAppUnitsPerDevPixel,
+ GetBlurAndSpreadRadius(aDestinationCtx->GetDrawTarget(), aAppUnitsPerDevPixel,
aBlurRadius, aSpreadRadius,
blurRadius, spreadRadius);
@@ -5674,7 +5674,7 @@ nsContextBoxBlur::BlurRectangle(gfxContext* aDestinationCtx,
}
/* static */ void
-nsContextBoxBlur::GetBlurAndSpreadRadius(gfxContext* aDestinationCtx,
+nsContextBoxBlur::GetBlurAndSpreadRadius(DrawTarget* aDestDrawTarget,
int32_t aAppUnitsPerDevPixel,
nscoord aBlurRadius,
nscoord aSpreadRadius,
@@ -5682,16 +5682,15 @@ nsContextBoxBlur::GetBlurAndSpreadRadius(gfxContext* aDestinationCtx,
IntSize& aOutSpreadRadius,
bool aConstrainSpreadRadius)
{
- gfxFloat scaleX = 1;
- gfxFloat scaleY = 1;
-
// Do blurs in device space when possible.
// Chrome/Skia always does the blurs in device space
// and will sometimes get incorrect results (e.g. rotated blurs)
- gfxMatrix transform = aDestinationCtx->CurrentMatrix();
+ Matrix transform = aDestDrawTarget->GetTransform();
// XXX: we could probably handle negative scales but for now it's easier just to fallback
+ gfxFloat scaleX, scaleY;
if (transform.HasNonAxisAlignedTransform() || transform._11 <= 0.0 || transform._22 <= 0.0) {
- transform = gfxMatrix();
+ scaleX = 1;
+ scaleY = 1;
} else {
scaleX = transform._11;
scaleY = transform._22;
@@ -5733,7 +5732,7 @@ nsContextBoxBlur::InsetBoxBlur(gfxContext* aDestinationCtx,
IntSize spreadRadius;
// Convert the blur and spread radius to device pixels
bool constrainSpreadRadius = false;
- GetBlurAndSpreadRadius(aDestinationCtx, aAppUnitsPerDevPixel,
+ GetBlurAndSpreadRadius(aDestinationCtx->GetDrawTarget(), aAppUnitsPerDevPixel,
aBlurRadiusAppUnits, aSpreadDistanceAppUnits,
blurRadius, spreadRadius, constrainSpreadRadius);
diff --git a/layout/base/nsCSSRendering.h b/layout/base/nsCSSRendering.h
index 28a7460eb8..8a731b0cee 100644
--- a/layout/base/nsCSSRendering.h
+++ b/layout/base/nsCSSRendering.h
@@ -858,6 +858,7 @@ protected:
*/
class nsContextBoxBlur {
typedef mozilla::gfx::Color Color;
+ typedef mozilla::gfx::DrawTarget DrawTarget;
typedef mozilla::gfx::RectCornerRadii RectCornerRadii;
public:
@@ -1006,7 +1007,7 @@ public:
mozilla::gfx::Point aShadowOffset);
protected:
- static void GetBlurAndSpreadRadius(gfxContext* aContext,
+ static void GetBlurAndSpreadRadius(DrawTarget* aDestDrawTarget,
int32_t aAppUnitsPerDevPixel,
nscoord aBlurRadius,
nscoord aSpreadRadius,
diff --git a/layout/base/tests/test_bug332655-2.html b/layout/base/tests/test_bug332655-2.html
index dc28ef6eba..b4dac3691b 100644
--- a/layout/base/tests/test_bug332655-2.html
+++ b/layout/base/tests/test_bug332655-2.html
@@ -14,7 +14,8 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=332655
Mozilla Bug 332655
-
+