If more than one trap is passed in then it's guaranteed that the

returned traps will have their left edge to the left of their right
edge, but if only one trap is passed in then the function always returns
without doing anything.  This results in incorrect rendering of SVG
paths with more than one subpath.

Currently calls to _cairo_bentley_ottmann_tessellate_rectangular_traps
are guarded by traps.has_intersections checks, so this is only a
theoretical bug.  But we'll eliminate the potential of the bug by
making the left side to be left of the right side, similar to what was
done in _cairo_bentley_ottmann_tessellate_boxes (commit 11b6c49c).

Patch authored by Tom Klein for Mozilla.

Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=90984
Ref: https://bugzilla.mozilla.org/show_bug.cgi?id=853889
Signed-off-by: Bryce Harrington <bryce@osg.samsung.com>

1 files changed, 12 insertions, 3 deletions

diff --git a/src/cairo-bentley-ottmann-rectangular.c b/src/cairo-bentley-ottmann-rectangular.c
index 5541bdc3a..29f902c1a 100644
--- a/src/cairo-bentley-ottmann-rectangular.c
+++ b/src/cairo-bentley-ottmann-rectangular.c
@@ -672,10 +672,19 @@ _cairo_bentley_ottmann_tessellate_rectangular_traps (cairo_traps_t *traps,
     cairo_status_t status;
     int i;
 
-    if (unlikely (traps->num_traps <= 1))
+   assert (traps->is_rectangular);
+
+    if (unlikely (traps->num_traps <= 1)) {
+        if (traps->num_traps == 1) {
+            cairo_trapezoid_t *trap = traps->traps;
+            if (trap->left.p1.x > trap->right.p1.x) {
+                cairo_line_t tmp = trap->left;
+                trap->left = trap->right;
+                trap->right = tmp;
+            }
+        }
 	return CAIRO_STATUS_SUCCESS;
-
-    assert (traps->is_rectangular);
+    }
 
     dump_traps (traps, "bo-rects-traps-in.txt");