Commit d557175d authored by mitz@apple.com's avatar mitz@apple.com
Browse files

<rdar://problem/8765498> REGRESSION (r72141): Cannot order prints with Aperture 3.1

Reviewed by Adele Peterson.

<rdar://problem/8884648> REGRESSION (r72141): Safari hangs when visiting a page on www.bfmtv.com
https://bugs.webkit.org/show_bug.cgi?id=52765

<rdar://problem/8890909> REGRESSION (r72141): Very Slow Rendering With Certain Markup
https://bugs.webkit.org/show_bug.cgi?id=52265

Source/WebCore: 

Test: fast/block/line-layout/negative-max-height.html

Integer overflow detection led to a block having a huge height. This manifested as broken layout
in the first bug and as extreme slowness in the latter bugs because of
https://bugs.webkit.org/show_bug.cgi?id=52832

* rendering/RootInlineBox.cpp:
(WebCore::RootInlineBox::alignBoxesInBlockDirection): Clamp maxHeight to 0 so the next line
cannot start above this line. The negative maxHeight also caused the integer overflow detection
logic to give the block a huge height.

LayoutTests: 

* fast/block/line-layout: Added.
* fast/block/line-layout/negative-max-height-expected.checksum: Added.
* fast/block/line-layout/negative-max-height-expected.png: Added.
* fast/block/line-layout/negative-max-height-expected.txt: Added.
* fast/block/line-layout/negative-max-height.html: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@76273 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent b5cbaed7
2011-01-20 Dan Bernstein <mitz@apple.com>
Reviewed by Adele Peterson.
<rdar://problem/8765498> REGRESSION (r72141): Cannot order prints with Aperture 3.1
<rdar://problem/8884648> REGRESSION (r72141): Safari hangs when visiting a page on www.bfmtv.com
https://bugs.webkit.org/show_bug.cgi?id=52765
<rdar://problem/8890909> REGRESSION (r72141): Very Slow Rendering With Certain Markup
https://bugs.webkit.org/show_bug.cgi?id=52265
* fast/block/line-layout: Added.
* fast/block/line-layout/negative-max-height-expected.checksum: Added.
* fast/block/line-layout/negative-max-height-expected.png: Added.
* fast/block/line-layout/negative-max-height-expected.txt: Added.
* fast/block/line-layout/negative-max-height.html: Added.
2011-01-20 Ryosuke Niwa <rniwa@webkit.org>
 
Unreviewed Chromium rebaseline for r76236.
......
6b0ecc73552409651fdf34f695a73063
\ No newline at end of file
layer at (0,0) size 800x600
RenderView at (0,0) size 800x600
layer at (0,0) size 800x600 layerType: background only
layer at (8,8) size 100x100
RenderBlock (positioned) zI: -1 {DIV} at (8,8) size 100x100 [bgcolor=#FF0000]
layer at (0,0) size 800x600 layerType: foreground only
RenderBlock {HTML} at (0,0) size 800x600
RenderBody {BODY} at (8,8) size 784x584
RenderBlock {DIV} at (0,0) size 100x50 [bgcolor=#008000]
RenderBlock {DIV} at (0,50) size 784x0
RenderBlock {DIV} at (0,-25) size 20x20
RenderText {#text} at (0,0) size 0x0
RenderBlock {DIV} at (0,50) size 100x50 [bgcolor=#008000]
<div style="position: absolute; width: 100px; height: 100px; background-color: red; z-index: -1;"></div>
<div style="height: 50px; background-color: green; width: 100px;"></div>
<div id="target">
<div style="display: inline-block; width: 20px; height: 20px; margin-top: -25px;"></div>
</div>
<div style="height: 50px; background-color: green; width: 100px;"></div>
2011-01-20 Dan Bernstein <mitz@apple.com>
Reviewed by Adele Peterson.
<rdar://problem/8765498> REGRESSION (r72141): Cannot order prints with Aperture 3.1
<rdar://problem/8884648> REGRESSION (r72141): Safari hangs when visiting a page on www.bfmtv.com
https://bugs.webkit.org/show_bug.cgi?id=52765
<rdar://problem/8890909> REGRESSION (r72141): Very Slow Rendering With Certain Markup
https://bugs.webkit.org/show_bug.cgi?id=52265
Test: fast/block/line-layout/negative-max-height.html
Integer overflow detection led to a block having a huge height. This manifested as broken layout
in the first bug and as extreme slowness in the latter bugs because of
https://bugs.webkit.org/show_bug.cgi?id=52832
* rendering/RootInlineBox.cpp:
(WebCore::RootInlineBox::alignBoxesInBlockDirection): Clamp maxHeight to 0 so the next line
cannot start above this line. The negative maxHeight also caused the integer overflow detection
logic to give the block a huge height.
2011-01-20 Yi Shen <yi.4.shen@nokia.com>
 
Reviewed by Eric Carlson.
......@@ -9538,11 +9538,11 @@
A5AFB34E115151A700B045CB /* StepRange.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StepRange.h; sourceTree = "<group>"; };
A5C974CF11485FF10066F2AB /* KeyEventCocoa.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = KeyEventCocoa.h; path = cocoa/KeyEventCocoa.h; sourceTree = "<group>"; };
A5C974D011485FF10066F2AB /* KeyEventCocoa.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; name = KeyEventCocoa.mm; path = cocoa/KeyEventCocoa.mm; sourceTree = "<group>"; };
A6148A6112E41D3A0044A784 /* DOMHTMLKeygenElementInternal.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DOMHTMLKeygenElementInternal.h; path = DOMHTMLKeygenElementInternal.h; sourceTree = "<group>"; };
A6148A6512E41D940044A784 /* DOMHTMLKeygenElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DOMHTMLKeygenElement.h; path = DOMHTMLKeygenElement.h; sourceTree = "<group>"; };
A6148A6612E41D940044A784 /* DOMHTMLKeygenElement.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; name = DOMHTMLKeygenElement.mm; path = DOMHTMLKeygenElement.mm; sourceTree = "<group>"; };
A6148A7612E41E3B0044A784 /* JSHTMLKeygenElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = JSHTMLKeygenElement.cpp; path = JSHTMLKeygenElement.cpp; sourceTree = "<group>"; };
A6148A7712E41E3B0044A784 /* JSHTMLKeygenElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = JSHTMLKeygenElement.h; path = JSHTMLKeygenElement.h; sourceTree = "<group>"; };
A6148A6112E41D3A0044A784 /* DOMHTMLKeygenElementInternal.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMHTMLKeygenElementInternal.h; sourceTree = "<group>"; };
A6148A6512E41D940044A784 /* DOMHTMLKeygenElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMHTMLKeygenElement.h; sourceTree = "<group>"; };
A6148A6612E41D940044A784 /* DOMHTMLKeygenElement.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMHTMLKeygenElement.mm; sourceTree = "<group>"; };
A6148A7612E41E3B0044A784 /* JSHTMLKeygenElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLKeygenElement.cpp; sourceTree = "<group>"; };
A6148A7712E41E3B0044A784 /* JSHTMLKeygenElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSHTMLKeygenElement.h; sourceTree = "<group>"; };
A6148A7F12E41ED10044A784 /* HTMLKeygenElement.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = HTMLKeygenElement.idl; sourceTree = "<group>"; };
A622A8F5122C44A600A785B3 /* BindingSecurity.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = BindingSecurity.h; path = generic/BindingSecurity.h; sourceTree = "<group>"; };
A622A8F6122C44A600A785B3 /* BindingSecurityBase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = BindingSecurityBase.cpp; path = generic/BindingSecurityBase.cpp; sourceTree = "<group>"; };
......@@ -266,6 +266,8 @@ int RootInlineBox::alignBoxesInBlockDirection(int heightOfBlock, GlyphOverflowAn
heightOfBlock += annotationsAdjustment;
}
maxHeight = max(0, maxHeight);
// Detect integer overflow.
if (heightOfBlock > numeric_limits<int>::max() - maxHeight)
return numeric_limits<int>::max();
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment