Bug 1420492 - avoid division by zero when constructing an nsSVGArcConverter r=dholbert

dom/svg/SVGPathSegUtils.cpp

@@ -372,12 +372,16 @@ TraverseArcAbs(const float* aArgs, SVGPathTraversalState& aState)
   if (aState.ShouldUpdateLengthAndControlPoints()) {
     float dist = 0;
     Point radii(aArgs[0], aArgs[1]);
-    Point bez[4] = { aState.pos, Point(0, 0), Point(0, 0), Point(0, 0) };
-    nsSVGArcConverter converter(aState.pos, to, radii, aArgs[2],
-                                aArgs[3] != 0, aArgs[4] != 0);
-    while (converter.GetNextSegment(&bez[1], &bez[2], &bez[3])) {
-      dist += CalcBezLengthHelper(bez, 4, 0, SplitCubicBezier);
-      bez[0] = bez[3];
+    if (radii.x == 0.0f || radii.y == 0.0f) {
+      dist = CalcDistanceBetweenPoints(aState.pos, to);
+    } else {
+      Point bez[4] = { aState.pos, Point(0, 0), Point(0, 0), Point(0, 0) };
+      nsSVGArcConverter converter(aState.pos, to, radii, aArgs[2],
+                                  aArgs[3] != 0, aArgs[4] != 0);
+      while (converter.GetNextSegment(&bez[1], &bez[2], &bez[3])) {
+        dist += CalcBezLengthHelper(bez, 4, 0, SplitCubicBezier);
+        bez[0] = bez[3];
+      }
     }
     aState.length += dist;
     aState.cp1 = aState.cp2 = to;
@@ -392,12 +396,16 @@ TraverseArcRel(const float* aArgs, SVGPathTraversalState& aState)
   if (aState.ShouldUpdateLengthAndControlPoints()) {
     float dist = 0;
     Point radii(aArgs[0], aArgs[1]);
-    Point bez[4] = { aState.pos, Point(0, 0), Point(0, 0), Point(0, 0) };
-    nsSVGArcConverter converter(aState.pos, to, radii, aArgs[2],
-                                aArgs[3] != 0, aArgs[4] != 0);
-    while (converter.GetNextSegment(&bez[1], &bez[2], &bez[3])) {
-      dist += CalcBezLengthHelper(bez, 4, 0, SplitCubicBezier);
-      bez[0] = bez[3];
+    if (radii.x == 0.0f || radii.y == 0.0f) {
+      dist = CalcDistanceBetweenPoints(aState.pos, to);
+    } else {
+      Point bez[4] = { aState.pos, Point(0, 0), Point(0, 0), Point(0, 0) };
+      nsSVGArcConverter converter(aState.pos, to, radii, aArgs[2],
+                                  aArgs[3] != 0, aArgs[4] != 0);
+      while (converter.GetNextSegment(&bez[1], &bez[2], &bez[3])) {
+        dist += CalcBezLengthHelper(bez, 4, 0, SplitCubicBezier);
+        bez[0] = bez[3];
+      }
     }
     aState.length += dist;
     aState.cp1 = aState.cp2 = to;

dom/svg/crashtests/1420492.html

@@ -0,0 +1,3 @@
+<svg>
+<animateMotion path='m4,5a0,3 6,012,1'>
+

dom/svg/crashtests/crashtests.list

@@ -90,3 +90,4 @@ load 1347617-1.svg
 load 1347617-2.svg
 load 1347617-3.svg
 load 1402798.html
+load 1420492.html

dom/svg/nsSVGPathDataParser.cpp

@@ -419,6 +419,8 @@ nsSVGArcConverter::nsSVGArcConverter(const Point& from,
                                      bool largeArcFlag,
                                      bool sweepFlag)
 {
+  MOZ_ASSERT(radii.x != 0.0f && radii.y != 0.0f, "Bad radii");
+
   const double radPerDeg = M_PI/180.0;
   mSegIndex = 0;
 

dom/svg/test/test_pathLength.html

@@ -16,6 +16,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=1024926
   <svg width="100%" height="1" id="svg">
     <path id="path_lines" d="M50,100l0,0l0,-50l100,0l86.3325,122.665z"></path>
     <path id="path_straight_curve" d="M0,0 C100,0 150,0 200,0" />
+    <path id="path_straight_arc" d="M0,0 A100,0 0 0 0 200, 0" />
   </svg>
 </div>
 <pre id="test">
@@ -44,6 +45,11 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=1024926
   is(path.getTotalLength(), 200, "Unexpected path length, for straight line " +
                                  "generated by 'C' command");
 
+  // Test a path with an arc command ("A") that is really a straight line.
+  path = document.getElementById("path_straight_arc");
+  is(path.getTotalLength(), 200, "Unexpected path length, for straight line " +
+                                 "generated by 'A' command");
+
   SimpleTest.finish();
 
 </script>