Subpixel layout: IntRect::infiniteRect() overflows when subpixel layout is enabled.

• Component: Layout and Rendering
• Status: RESOLVED FIXED

[zalan]

svg/custom/masking-clipping-hidpi.svg

[zalan]

overflow caused by IntRect::infiniteRect() (static IntRect infiniteRect(-std::numeric_limits<int>::max() / 2, -std::numeric_limits<int>::max() / 2, std::numeric_limits<int>::max(), std::numeric_limits<int>::max()); ) causes unexpected clipping -> missing content.

[zalan]

This should help

diff --git a/Source/WebCore/platform/graphics/IntRect.h b/Source/WebCore/platform/graphics/IntRect.h
index 0a6d4aa..130fd83 100644
--- a/Source/WebCore/platform/graphics/IntRect.h
+++ b/Source/WebCore/platform/graphics/IntRect.h
@@ -27,6 +27,7 @@
 #define IntRect_h
 
 #include "IntPoint.h"
+#include "LayoutUnit.h"
 #include <wtf/Vector.h>
 
 #if USE(CG)
@@ -236,7 +237,8 @@ inline bool operator!=(const IntRect& a, const IntRect& b)
 
 inline IntRect IntRect::infiniteRect()
 {
-    static IntRect infiniteRect(-std::numeric_limits<int>::max() / 2, -std::numeric_limits<int>::max() / 2, std::numeric_limits<int>::max(), std::numeric_limits<int>::max());
+    static IntRect infiniteRect(-LayoutUnit::max() / 2, -LayoutUnit::max() / 2, LayoutUnit::max(), LayoutUnit::max());
     return infiniteRect;
 }

[Tim Horton]

Oh, yes, one of the other ports noticed that we should do this (I didn't want to, but eventually became resigned to it) but closed their bug in a different way so I forgot about it. r+ if you post a patch.

[zalan]

Created attachment 221555 [details]
Patch

[WebKit Commit Bot]

Comment on attachment 221555 [details]
Patch

Clearing flags on attachment: 221555

Committed r162273: <http://trac.webkit.org/changeset/162273>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[Sam Weinig]

This doesn't sit right with me (why should something called infiniteRect() have anything to do with LayoutUnits?)  Can we at least add a comment explaining this weirdness?