Panic with a clipPath with objectBoundingBox on an empty group
The attached SVG crashes both librsvg 2.42.x and master.
<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN"
"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<svg viewBox="0 0 640 480" version="1.1" xmlns="http://www.w3.org/2000/svg">
<defs>
<clipPath id="foo" clipPathUnits="objectBoundingBox">
<rect x="0" y="0" width="10" height="10"/>
</clipPath>
</defs>
<g clip-path="url(#foo)"/>
</svg>
This panic is similar in nature to #277 (closed) - we are trying to get the bbox of the empty <g>
for the purposes of objectBoundingBox
.
In librsvg 2.42, we panic in rsvg-cairo-clip.c
because we make a degenerate matrix here, since the bbox has size zero:
161 if (clip_units == objectBoundingBox) {
162 cairo_matrix_t bbtransform;
163 cairo_matrix_init (&bbtransform,
164 bbox->rect.width,
165 0,
166 0,
167 bbox->rect.height,
168 bbox->rect.x,
169 bbox->rect.y);
(gdb) p bbox->rect
$1 = {x = 0, y = 0, width = 0, height = 0}
And in librsvg master, we panic in the unwrap()
in clip_path.rs
:
let child_matrix = if clip_units == ClipPathUnits(CoordUnits::ObjectBoundingBox) {
let rect = orig_bbox.rect.unwrap();
If the bbox is empty, there's nothing to clip and we shouldn't try to do that.