Attachment 207772 Details for Bug 119273 – Patch

[patch] Patch

bug-119273-20130731002029.patch (text/plain), 3.91 KB, created by Javier Fernandez on 2013-07-30 15:20:31 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Javier Fernandez

Created: 2013-07-30 15:20:31 PDT

Size: 3.91 KB

patch

obsolete

>Subversion Revision: 153460
>diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
>index a476d8679579e8fe9da4794e57a7a6d9bd9d2c20..361a54ebee705c173e65475e3773e07936e6f518 100644
>--- a/Source/WebCore/ChangeLog
>+++ b/Source/WebCore/ChangeLog
>@@ -1,3 +1,18 @@
>+2013-07-30  Javier Fernandez  <jfernandez@igalia.com>
>+
>+        Arithmetic overflow when computing max-height CSS property with subpixel layout
>+        https://bugs.webkit.org/show_bug.cgi?id=119273
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Verifying that adding the bordersPlusPadding to the logical height does not exceed
>+        the LayoutUnit::max().
>+
>+        Test: fast/css/max-height-huge-value.html
>+
>+        * rendering/RenderBox.cpp:
>+        (WebCore::RenderBox::adjustBorderBoxLogicalHeightForBoxSizing):
>+
> 2013-07-29  Carlos Garcia Campos  <cgarcia@igalia.com>
> 
>         Unreviewed. Fix make distcheck.
>diff --git a/Source/WebCore/rendering/RenderBox.cpp b/Source/WebCore/rendering/RenderBox.cpp
>index 325e39ced8fc99bd5a6e0fc53af153f405388ee1..1780b5c1b56a7586c93897b972f990e732cdc5a8 100644
>--- a/Source/WebCore/rendering/RenderBox.cpp
>+++ b/Source/WebCore/rendering/RenderBox.cpp
>@@ -991,7 +991,8 @@ LayoutUnit RenderBox::adjustBorderBoxLogicalHeightForBoxSizing(LayoutUnit height
> {
>     LayoutUnit bordersPlusPadding = borderAndPaddingLogicalHeight();
>     if (style()->boxSizing() == CONTENT_BOX)
>-        return height + bordersPlusPadding;
>+        if ((LayoutUnit::max() - height) > bordersPlusPadding)
>+            return height + bordersPlusPadding;
>     return max(height, bordersPlusPadding);
> }
> 
>diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
>index 8a7ced88ffe5a2493fd86daed026098d510d3ab2..6db4ab1cdc1ea12e8407ef964437e31838010009 100644
>--- a/LayoutTests/ChangeLog
>+++ b/LayoutTests/ChangeLog
>@@ -1,3 +1,13 @@
>+2013-07-30  Javier Fernandez  <jfernandez@igalia.com>
>+
>+        Arithmetic overflow when computing max-height CSS property with subpixel layout
>+        https://bugs.webkit.org/show_bug.cgi?id=119273
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * fast/css/max-height-huge-value-expected.html: Added.
>+        * fast/css/max-height-huge-value.html: Added.
>+
> 2013-07-29  Chris Curtis  <chris_curtis@apple.com>
> 
>         Eager stack trace for error objects.
>diff --git a/LayoutTests/fast/css/max-height-huge-value-expected.html b/LayoutTests/fast/css/max-height-huge-value-expected.html
>new file mode 100644
>index 0000000000000000000000000000000000000000..ca4865c251fcc37c3d9864ffc25c838601b8dfdb
>--- /dev/null
>+++ b/LayoutTests/fast/css/max-height-huge-value-expected.html
>@@ -0,0 +1,18 @@
>+<!doctype html>
>+<html lang="en">
>+<head>
>+    <style>
>+    .max {
>+      width: 100px;
>+      border: 2px solid blue;
>+      overflow: hidden;
>+      max-height: 20000000px;
>+    }
>+    </style>
>+</head>
>+<body>
>+    <p>Test for <a href="https://bugs.webkit.org/show_bug.cgi?id=119273 "> Arithmetic overflow when computing max-height CSS property with subpixel layout</a>.</p>
>+    <p>A huge max-height value causes an arithmetic overflow during the layout process.</p>
>+    <div class="max"><p>Testing.</p></div>
>+</body>
>+</html>
>diff --git a/LayoutTests/fast/css/max-height-huge-value.html b/LayoutTests/fast/css/max-height-huge-value.html
>new file mode 100644
>index 0000000000000000000000000000000000000000..64ecdcc3ece641989751c083e082314d6192ef91
>--- /dev/null
>+++ b/LayoutTests/fast/css/max-height-huge-value.html
>@@ -0,0 +1,18 @@
>+<!doctype html>
>+<html lang="en">
>+<head>
>+    <style>
>+    .max {
>+      width: 100px;
>+      border: 2px solid blue;
>+      overflow: hidden;
>+      max-height: 2000000000px;
>+    }
>+    </style>
>+</head>
>+<body>
>+    <p>Test for <a href="https://bugs.webkit.org/show_bug.cgi?id=119273 "> Arithmetic overflow when computing max-height CSS property with subpixel layout</a>.</p>
>+    <p>A huge max-height value causes an arithmetic overflow during the layout process.</p>
>+    <div class="max"><p>Testing.</p></div>
>+</body>
>+</html>

Actions: View | Formatted Diff | Diff

Attachments on bug 119273: 207763 | 207772 | 215492 | 215493 | 215495 | 215496 | 218970