Bug 133272 – Subpixel layout: Legacy Element.offset* client* return values are invalid in certain cases.

• Component: Layout and Rendering
• Status: RESOLVED FIXED

[zalan]

In some cases legacy values need to be floored, in other cases they need rounding.

[zalan]

Created attachment 232055 [details]
Patch

[WebKit Commit Bot]

Comment on attachment 232055 [details]
Patch

Clearing flags on attachment: 232055

Committed r169346: <http://trac.webkit.org/changeset/169346>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[Darin Adler]

Comment on attachment 232055 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=232055&action=review

> Source/WebCore/dom/Element.cpp:674
> +        return convertToNonSubpixelValueIfNeeded(adjustForLocalZoom(renderer->offsetLeft(), *renderer, zoomFactor), renderer->document(), zoomFactor == 1 ? Floor : Round);

This relies on undefined behavior and can be a real problem in practice. There is no guarantee on the order of evaluation of arguments when calling a function. Setting zoomFactor as a side effect in one argument and looking at zoomFactor as part of the expression for another argument can give different results on different compilers. Please split the call to adjustForLocalZoom out into a separate expression.

> Source/WebCore/dom/Element.cpp:684
> +        return convertToNonSubpixelValueIfNeeded(adjustForLocalZoom(renderer->offsetTop(), *renderer, zoomFactor), renderer->document(), zoomFactor == 1 ? Floor : Round);

Same problem here.