Bug 94317 – Counter values not clamped on integer overflow for two counters

• Status: RESOLVED
• Resolution: FIXED
• Component: Layout and Rendering

[Elliott Sprehn]

We clamp the summation of the values in a counter-increment on integer overflow but we don't do this when you have two counters in a row:

div:before { counter-increment: 2147483647; /* MAX_INT */ }

<div></div>
<div></div>

See: https://trac.webkit.org/changeset/102528

Should be an easy fix of adding the attached test and using clampToInteger in RenderCounter.cpp

[Elliott Sprehn]

Btw, the reason we do this for counter-increment but not when computing counters in a scope is because the CSS2.1 test suite has a whole bunch of tests like this one:

http://test.csswg.org/suites/css2.1/20110111/html4/counter-increment-015.htm

But out of the 50+ tests it never tests having more than one counter() in a scope.

I can't find reference about integer overflow the spec, and CSS3 values claims CSS is "infinite precision" which makes me think perhaps the tests in 2.1 are wrong and we should always overflow and never clamp.

Note: Gecko and Opera never clamp so they fail those tests.

[Tab Atkins]

No, we should absolutely not overflow.

We commented out the section about required limits in <http://dev.w3.org/csswg/css3-values/>, but from testing in various things, we were going to require impls to support at least +-(2^23 - 1).  Also, you were required to clamp if a number was outside your range.

We'll put the section back into level 4 of the spec, it was just slowing down CR.

[Ahmad Saleem]

@Vitor - is it similar to bug, which was fixed by you?

https://wpt.fyi/results/css/css-lists/counter-reset-increment-overflow-underflow.html?label=master&label=experimental&aligned&q=counter%20overflow

Here: https://bugs.webkit.org/show_bug.cgi?id=258730

[Karl Dubost]

This needs a test with two counters.

[Radar WebKit Bug Importer]

<rdar://problem/142420341>

[Yulun Wu]

It looks like Vitor's CL resolves this issue and has overflow/underflow tests, each with three counters. Marking this as resolved.