Bug 105961 – Fix overflow in LayoutUnit::ceil and floor for SATURATED_LAYOUT_ARITHMETIC

• Component: Platform
• Status: RESOLVED FIXED

[Emil A Eklund]

The LayoutUnit::ceil and floor methods overflows if given the intMaxForLayoutUnit and intMinForLayoutUnit values respectively.

[Emil A Eklund]

Created attachment 181086 [details]
Patch

[Emil A Eklund]

Created attachment 181095 [details]
Patch

[Emil A Eklund]

Created attachment 181112 [details]
Patch

[Emil A Eklund]

Updated tests to also cover MAX - 1, MAX - 0.5, MIN + 1 and MIN + 0.5

[Levi Weintraub]

Comment on attachment 181112 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=181112&action=review

This seems fine to me. I'd be curious to see the perf results (which I suspect are negligible), but since this flag isn't enabled, I think it's enough to watch the overall impact of enabling it.

> Source/WebCore/ChangeLog:3
> +        Fix overflow in LayoutUnit::ceil and flor for SATURATED_LAYOUT_ARITHMETIC

Typo: 'flor'

> Source/WebCore/platform/LayoutUnit.h:230
> +        if (UNLIKELY(m_value <= INT_MIN + kEffectiveFixedPointDenominator - 1))
> +            return intMinForLayoutUnit;

I'm not used to seeing UNLIKELY in WebCore code, but I imagine if I'm going to run into it, I'd expect it in platform/.

> Tools/ChangeLog:3
> +        Fix overflow in LayoutUnit::ceil and flor for SATURATED_LAYOUT_ARITHMETIC

'flor'

[Emil A Eklund]

Created attachment 181208 [details]
Patch for landing

[WebKit Review Bot]

Comment on attachment 181208 [details]
Patch for landing

Clearing flags on attachment: 181208

Committed r138736: <http://trac.webkit.org/changeset/138736>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.