138554 2014-11-09 20:22:24 -0800 Assertion in border drawing code with this testcase 2015-01-05 16:09:32 -0800 1 1 1 Unclassified WebKit Layout and Rendering 528+ (Nightly build) Unspecified Unspecified RESOLVED WORKSFORME InRadar P2 Normal --- 1 simon.fraser webkit-unassigned simon.fraser webkit-bug-importer zalan oldest_to_newest 1047448 0 241270 simon.fraser 2014-11-09 20:22:24 -0800 Created attachment 241270 testcase The attached test case, from bug 108619, asserts in border drawing code if you skip the geometry map assertion. At: y2 = roundToDevicePixel(y2, deviceScaleFactor); y2 is 33554432, and comes back negative. float foo = 33554432; LayoutUnit bar(foo); reproduces the issue. At m_value = clampTo<float>(value * kFixedPointDenominator, static_cast<float>(INT_MIN), static_cast<float>(INT_MAX)); m_value becomes negative. 1057076 1 webkit-bug-importer 2014-12-19 10:53:36 -0800 <rdar://problem/19310242> 1058849 2 zalan 2015-01-05 16:09:32 -0800 Can't repro border drawing assert after r177845. -> bug 139888 241270 2014-11-09 20:22:24 -0800 2014-11-09 20:22:24 -0800 testcase layoutunit-overflow.html text/html 163 simon.fraser PCFET0NUWVBFIGh0bWw+CjxpbWcgaGVpZ2h0PSI0NDY2MDcwNzNweCI+CjxzdHlsZT4gCjwhW0NE QVRBWyAKKiB7fQoqIHsKICAgIGRpc3BsYXk6dGFibGUtY2FwdGlvbjsKICAgIG91dGxpbmUtc3R5 bGU6cmlkZ2U7CiAgICBvdmVyZmxvdy14OmF1dG87ICAgIAp9Cl1dPgo8L3N0eWxlPg==