[gtk/cherry-pick-0903ad48] Merge branch 'wip/otte/for-master' into 'master'

[Benjamin Otte <otte src gnome org>]

commit 481ab5cf499137b6497ab8790cbd664869889d85
Author: Benjamin Otte <otte benjamin googlemail com>
Date:   Wed Nov 10 16:44:56 2021 +0000

    Merge branch 'wip/otte/for-master' into 'master'
    
    css: Don't crash when color stop offsets descend
    
    Closes #4424
    
    See merge request GNOME/gtk!4143
    
    (cherry picked from commit 0903ad48f0a2a7579703f16d137949c10e0423e6)
    
    46f8600b css: Don't crash when color stop offsets descend

 gtk/gtkcssimageradial.c                                       | 2 +-
 testsuite/reftests/css-radial-gradient-colorstop-crash.css    | 7 +++++++
 testsuite/reftests/css-radial-gradient-colorstop-crash.ref.ui | 8 ++++++++
 testsuite/reftests/css-radial-gradient-colorstop-crash.ui     | 9 +++++++++
 testsuite/reftests/meson.build                                | 3 +++
 5 files changed, 28 insertions(+), 1 deletion(-)
---
diff --git a/gtk/gtkcssimageradial.c b/gtk/gtkcssimageradial.c
index 4b36a1e165..d43bf75173 100644
--- a/gtk/gtkcssimageradial.c
+++ b/gtk/gtkcssimageradial.c
@@ -178,7 +178,7 @@ gtk_css_image_radial_snapshot (GtkCssImage *image,
       else
         pos = MIN (1.0, _gtk_css_number_value_get (stop->offset, hradius) / hradius);
 
-      pos = MAX (pos, 0);
+      pos = MAX (pos, offset);
       step = (pos - offset) / (i - last);
       for (last = last + 1; last <= i; last++)
         {
diff --git a/testsuite/reftests/css-radial-gradient-colorstop-crash.css 
b/testsuite/reftests/css-radial-gradient-colorstop-crash.css
new file mode 100644
index 0000000000..bc64f2ed0e
--- /dev/null
+++ b/testsuite/reftests/css-radial-gradient-colorstop-crash.css
@@ -0,0 +1,7 @@
+window {
+  background: red;
+}
+
+#test {
+  background: radial-gradient(circle, red 100%, blue 0%, red 100%);
+}
diff --git a/testsuite/reftests/css-radial-gradient-colorstop-crash.ref.ui 
b/testsuite/reftests/css-radial-gradient-colorstop-crash.ref.ui
new file mode 100644
index 0000000000..778a999b05
--- /dev/null
+++ b/testsuite/reftests/css-radial-gradient-colorstop-crash.ref.ui
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<interface>
+  <object class="GtkWindow">
+    <property name="width_request">10</property>
+    <property name="height_request">10</property>
+    <property name="decorated">0</property>
+  </object>
+</interface>
diff --git a/testsuite/reftests/css-radial-gradient-colorstop-crash.ui 
b/testsuite/reftests/css-radial-gradient-colorstop-crash.ui
new file mode 100644
index 0000000000..75379ada9f
--- /dev/null
+++ b/testsuite/reftests/css-radial-gradient-colorstop-crash.ui
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<interface>
+  <object class="GtkWindow">
+    <property name="name">test</property>
+    <property name="width_request">10</property>
+    <property name="height_request">10</property>
+    <property name="decorated">0</property>
+  </object>
+</interface>
diff --git a/testsuite/reftests/meson.build b/testsuite/reftests/meson.build
index 59c9416994..ab9f51d413 100644
--- a/testsuite/reftests/meson.build
+++ b/testsuite/reftests/meson.build
@@ -225,6 +225,9 @@ testdata = [
   'css-multi-state.css',
   'css-multi-state.ref.ui',
   'css-multi-state.ui',
+  'css-radial-gradient-colorstop-crash.css',
+  'css-radial-gradient-colorstop-crash.ref.ui',
+  'css-radial-gradient-colorstop-crash.ui',
   'data-url.css',
   'data-url.ref.ui',
   'data-url.ui',