Re: crash in _fill_xrgb32_lerp_opaque_spans

Hello!

I was able to narrow down the problem. Certain polygons make sub_row call
cell_list_add_subspan (cairo-tor_scan-converter.c) with x1 > x2, which in
complex multi-polygon shapes results in memory corruption. Here is the
simplest sequence which causes x1 > x2 in cell_list_add_subspan:

   double b0_x = 57.991139090401816;
   double b0_y = 67.724516159057615;
   double b1_x = 58.011249302455383;
   double b1_y = 73.545238752365108;
   double e0_x = 57.991139090401816;
   double e0_y = 67.724516159057615;
   double e1_x = 58.011249302455383;
   double e1_y = 72.089769290924067;

   cairo_move_to(painter, b0_x, b0_y);
   cairo_line_to(painter, e0_x, e0_y);
   cairo_line_to(painter, e1_x, e1_y);
   cairo_line_to(painter, b1_x, b1_y);
   cairo_line_to(painter, b0_x, b0_y);
   cairo_fill(painter);

With best regards,
Ilya

-- 
cairo mailing list
[email protected]
http://lists.cairographics.org/mailman/listinfo/cairo