From a1bdbcfff9911485043b0283d762a6a6a195ba76 Mon Sep 17 00:00:00 2001
From: Milan Sreckovic <milan@mozilla.com>
Date: Mon, 19 Jan 2015 14:19:25 -0500
Subject: [PATCH] Bug 1121835: Deal with non-finite values in Path calls.
 r=bschouten

---
 gfx/2d/BasePoint.h | 10 ++++++++++
 gfx/2d/PathCG.cpp  | 25 ++++++++++++++++++++++---
 2 files changed, 32 insertions(+), 3 deletions(-)

diff --git a/gfx/2d/BasePoint.h b/gfx/2d/BasePoint.h
index 6e59b6b6cb2..4bd60275f7f 100644
--- a/gfx/2d/BasePoint.h
+++ b/gfx/2d/BasePoint.h
@@ -9,6 +9,8 @@
 #include <cmath>
 #include "mozilla/Attributes.h"
 #include "mozilla/ToString.h"
+#include "mozilla/FloatingPoint.h"
+#include "mozilla/TypeTraits.h"
 
 namespace mozilla {
 namespace gfx {
@@ -80,6 +82,14 @@ struct BasePoint {
     return *static_cast<Sub*>(this);
   }
 
+  // "Finite" means not inf and not NaN
+  bool IsFinite() const
+  {
+    typedef typename mozilla::Conditional<mozilla::IsSame<T, float>::value, float, double>::Type FloatType;
+    return (mozilla::IsFinite(FloatType(x)) && mozilla::IsFinite(FloatType(y)));
+    return true;
+  }
+
   friend std::ostream& operator<<(std::ostream& stream, const BasePoint<T, Sub, Coord>& aPoint) {
     return stream << '(' << aPoint.x << ',' << aPoint.y << ')';
   }
diff --git a/gfx/2d/PathCG.cpp b/gfx/2d/PathCG.cpp
index 6fd6dddff2d..0798a6ee3c1 100644
--- a/gfx/2d/PathCG.cpp
+++ b/gfx/2d/PathCG.cpp
@@ -20,12 +20,19 @@ PathBuilderCG::~PathBuilderCG()
 void
 PathBuilderCG::MoveTo(const Point &aPoint)
 {
+  if (!aPoint.IsFinite()) {
+    return;
+  }
   CGPathMoveToPoint(mCGPath, nullptr, aPoint.x, aPoint.y);
 }
 
 void
 PathBuilderCG::LineTo(const Point &aPoint)
 {
+  if (!aPoint.IsFinite()) {
+    return;
+  }
+
   if (CGPathIsEmpty(mCGPath))
     MoveTo(aPoint);
   else
@@ -37,6 +44,9 @@ PathBuilderCG::BezierTo(const Point &aCP1,
                          const Point &aCP2,
                          const Point &aCP3)
 {
+  if (!aCP1.IsFinite() || !aCP2.IsFinite() || !aCP3.IsFinite()) {
+    return;
+  }
 
   if (CGPathIsEmpty(mCGPath))
     MoveTo(aCP1);
@@ -49,13 +59,17 @@ PathBuilderCG::BezierTo(const Point &aCP1,
 
 void
 PathBuilderCG::QuadraticBezierTo(const Point &aCP1,
-                                  const Point &aCP2)
+                                 const Point &aCP2)
 {
+  if (!aCP1.IsFinite() || !aCP2.IsFinite()) {
+    return;
+  }
+
   if (CGPathIsEmpty(mCGPath))
     MoveTo(aCP1);
   CGPathAddQuadCurveToPoint(mCGPath, nullptr,
-                              aCP1.x, aCP1.y,
-                              aCP2.x, aCP2.y);
+                            aCP1.x, aCP1.y,
+                            aCP2.x, aCP2.y);
 }
 
 void
@@ -69,6 +83,11 @@ void
 PathBuilderCG::Arc(const Point &aOrigin, Float aRadius, Float aStartAngle,
                  Float aEndAngle, bool aAntiClockwise)
 {
+  if (!aOrigin.IsFinite() || !IsFinite(aRadius) ||
+      !IsFinite(aStartAngle) || !IsFinite(aEndAngle)) {
+    return;
+  }
+
   // Disabled for now due to a CG bug when using CGPathAddArc with stroke
   // dashing and rotation transforms that are multiples of 90 degrees. See:
   // https://bugzilla.mozilla.org/show_bug.cgi?id=949661#c8