Commit 70c2e451 authored by bdakin@apple.com's avatar bdakin@apple.com
Browse files

WebCore: Fix for https://bugs.webkit.org/show_bug.cgi?id=32000 Crash in

Safari caused by extreme column-gap and column-width values 
-and corresponding-
<rdar://problem/7425433>

Reviewed by Oliver Hunt.

Prevent desiredColumnCount from being less than 1 since it is used 
as a divisor.
* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::calcColumnWidth):

LayoutTests: Test for https://bugs.webkit.org/show_bug.cgi?id=32000 Crash in 
Safari caused by extreme column-gap and column-width values 
-and corresponding-
<rdar://problem/7425433>

Reviewed by Oliver Hunt.

* fast/multicol/huge-column-gap-crash-expected.txt: Added.
* fast/multicol/huge-column-gap-crash.html: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@51517 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent 53c40236
2009-11-30 Beth Dakin <bdakin@apple.com>
Reviewed by Oliver Hunt.
Test for https://bugs.webkit.org/show_bug.cgi?id=32000 Crash in
Safari caused by extreme column-gap and column-width values
-and corresponding-
<rdar://problem/7425433>
* fast/multicol/huge-column-gap-crash-expected.txt: Added.
* fast/multicol/huge-column-gap-crash.html: Added.
2009-11-30 Alexey Proskuryakov <ap@apple.com>
 
Reviewed by Oliver Hunt.
<html>
<head>
<style>
body {
-webkit-column-width: .600pt;
-webkit-column-gap: 2261953074155095154;
}
</style>
<script>
if (window.layoutTestController)
layoutTestController.dumpAsText();
</script>
</head>
<body class="test">
This test passes if it does not crash.
</body>
</html>
2009-11-30 Beth Dakin <bdakin@apple.com>
Reviewed by Oliver Hunt.
Fix for https://bugs.webkit.org/show_bug.cgi?id=32000 Crash in
Safari caused by extreme column-gap and column-width values
-and corresponding-
<rdar://problem/7425433>
Prevent desiredColumnCount from being less than 1 since it is used
as a divisor.
* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::calcColumnWidth):
2009-11-30 Alexey Proskuryakov <ap@apple.com>
 
Reviewed by Oliver Hunt.
......@@ -3553,11 +3553,15 @@ void RenderBlock::calcColumnWidth()
desiredColumnWidth = (availWidth - (desiredColumnCount - 1) * colGap) / desiredColumnCount;
} else if (colGap < availWidth) {
desiredColumnCount = availWidth / colGap;
if (desiredColumnCount < 1)
desiredColumnCount = 1;
desiredColumnWidth = (availWidth - (desiredColumnCount - 1) * colGap) / desiredColumnCount;
}
} else if (style()->hasAutoColumnCount()) {
if (colWidth < availWidth) {
desiredColumnCount = (availWidth + colGap) / (colWidth + colGap);
if (desiredColumnCount < 1)
desiredColumnCount = 1;
desiredColumnWidth = (availWidth - (desiredColumnCount - 1) * colGap) / desiredColumnCount;
}
} else {
......@@ -3567,6 +3571,8 @@ void RenderBlock::calcColumnWidth()
desiredColumnWidth = colWidth;
} else if (colWidth < availWidth) {
desiredColumnCount = (availWidth + colGap) / (colWidth + colGap);
if (desiredColumnCount < 1)
desiredColumnCount = 1;
desiredColumnWidth = (availWidth - (desiredColumnCount - 1) * colGap) / desiredColumnCount;
}
}
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment