Skip to content

Fix panic caused by oversized filter regions - #1079

Merged
LaurenzV merged 3 commits into
linebender:mainfrom
StefanoD:fix-fecomposite-arithmetic-huge-region-panic
Aug 1, 2026
Merged

Fix panic caused by oversized filter regions#1079
LaurenzV merged 3 commits into
linebender:mainfrom
StefanoD:fix-fecomposite-arithmetic-huge-region-panic

Conversation

@StefanoD

Copy link
Copy Markdown
Contributor

The source pixmap of a filtered group is clamped to max_bbox in render_group, but the filter region in apply_inner was derived directly from the unclamped filter rect. When the filter region was larger than the clamped buffer, feComposite with the arithmetic operator panicked on a size mismatch, since it requires its inputs and destination to have identical dimensions:

assertion failed: src1.height == src2.height && src1.height == dest.height

All intermediate filter images are expected to share the source's dimensions, so clamp the region to the source bounds. This keeps every buffer the same size and makes the affected SVG render correctly instead of crashing (or being silently cleared).

This also fixes the huge-region test, whose reference image previously captured the buggy behaviour where the filtered element disappeared; it now renders the blurred shape correctly.

Fixes #1021. Fixes #1007.

Generated by Claude.


Note: I accidentally closed the original PR (#1061) by deleting my fork, which auto-closed it. This reopens the same change — the branch and commits are unchanged.

The source pixmap of a filtered group is clamped to `max_bbox` in
`render_group`, but the filter `region` in `apply_inner` was derived
directly from the unclamped filter rect. When the filter region was
larger than the clamped buffer, `feComposite` with the `arithmetic`
operator panicked on a size mismatch, since it requires its inputs and
destination to have identical dimensions:

    assertion failed: src1.height == src2.height && src1.height == dest.height

All intermediate filter images are expected to share the source's
dimensions, so clamp the region to the source bounds. This keeps every
buffer the same size and makes the affected SVG render correctly instead
of crashing (or being silently cleared).

This also fixes the `huge-region` test, whose reference image previously
captured the buggy behaviour where the filtered element disappeared; it
now renders the blurred shape correctly.

Fixes linebender#1021. Fixes linebender#1007.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@LaurenzV LaurenzV changed the title Fix panic in feComposite arithmetic with oversized filter region Fix panic caused by oversized filter regions Aug 1, 2026
@LaurenzV
LaurenzV force-pushed the fix-fecomposite-arithmetic-huge-region-panic branch from 6eb4472 to 0e62915 Compare August 1, 2026 06:34
@LaurenzV

LaurenzV commented Aug 1, 2026

Copy link
Copy Markdown
Collaborator

I just noticed there seem to be quite a few other issues related to filters, but this definitely is an improvement to before, so LGTM.

@LaurenzV
LaurenzV merged commit 6bc5278 into linebender:main Aug 1, 2026
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Crash on specific svg file Specific SVG input file causing panic

2 participants