[gtk/wip/otte/for-master] css: Don't crash when color stop offsets descend

[Benjamin Otte <otte src gnome org>]

commit 46f8600b6a92f63fc34babff1b78d41b3b8301db
Author: Benjamin Otte <otte redhat com>
Date:   Wed Nov 10 17:26:13 2021 +0100

    css: Don't crash when color stop offsets descend
    
    Testcase included.
    
    Fixes #4424

 gtk/gtkcssimageradial.c                                       | 2 +-
 testsuite/reftests/css-radial-gradient-colorstop-crash.css    | 7 +++++++
 testsuite/reftests/css-radial-gradient-colorstop-crash.ref.ui | 8 ++++++++
 testsuite/reftests/css-radial-gradient-colorstop-crash.ui     | 9 +++++++++
 testsuite/reftests/meson.build                                | 3 +++
 5 files changed, 28 insertions(+), 1 deletion(-)
---
diff --git a/gtk/gtkcssimageradial.c b/gtk/gtkcssimageradial.c
index 4b36a1e165..d43bf75173 100644
--- a/gtk/gtkcssimageradial.c
+++ b/gtk/gtkcssimageradial.c
@@ -178,7 +178,7 @@ gtk_css_image_radial_snapshot (GtkCssImage *image,
       else
         pos = MIN (1.0, _gtk_css_number_value_get (stop->offset, hradius) / hradius);
 
-      pos = MAX (pos, 0);
+      pos = MAX (pos, offset);
       step = (pos - offset) / (i - last);
       for (last = last + 1; last <= i; last++)
         {
diff --git a/testsuite/reftests/css-radial-gradient-colorstop-crash.css 
b/testsuite/reftests/css-radial-gradient-colorstop-crash.css
new file mode 100644
index 0000000000..bc64f2ed0e
--- /dev/null
+++ b/testsuite/reftests/css-radial-gradient-colorstop-crash.css
@@ -0,0 +1,7 @@
+window {
+  background: red;
+}
+
+#test {
+  background: radial-gradient(circle, red 100%, blue 0%, red 100%);
+}
diff --git a/testsuite/reftests/css-radial-gradient-colorstop-crash.ref.ui 
b/testsuite/reftests/css-radial-gradient-colorstop-crash.ref.ui
new file mode 100644
index 0000000000..778a999b05
--- /dev/null
+++ b/testsuite/reftests/css-radial-gradient-colorstop-crash.ref.ui
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<interface>
+  <object class="GtkWindow">
+    <property name="width_request">10</property>
+    <property name="height_request">10</property>
+    <property name="decorated">0</property>
+  </object>
+</interface>
diff --git a/testsuite/reftests/css-radial-gradient-colorstop-crash.ui 
b/testsuite/reftests/css-radial-gradient-colorstop-crash.ui
new file mode 100644
index 0000000000..75379ada9f
--- /dev/null
+++ b/testsuite/reftests/css-radial-gradient-colorstop-crash.ui
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<interface>
+  <object class="GtkWindow">
+    <property name="name">test</property>
+    <property name="width_request">10</property>
+    <property name="height_request">10</property>
+    <property name="decorated">0</property>
+  </object>
+</interface>
diff --git a/testsuite/reftests/meson.build b/testsuite/reftests/meson.build
index 8ef810ae7d..f66ace543c 100644
--- a/testsuite/reftests/meson.build
+++ b/testsuite/reftests/meson.build
@@ -258,6 +258,9 @@ testdata = [
   'css-multi-state.css',
   'css-multi-state.ref.ui',
   'css-multi-state.ui',
+  'css-radial-gradient-colorstop-crash.css',
+  'css-radial-gradient-colorstop-crash.ref.ui',
+  'css-radial-gradient-colorstop-crash.ui',
   'data-url.css',
   'data-url.ref.ui',
   'data-url.ui',