Heap-use-after-free in WebCore::RenderLayerModelObject::hasSelfPaintingLayer
authorcommit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 22 May 2013 22:08:21 +0000 (22:08 +0000)
committercommit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 22 May 2013 22:08:21 +0000 (22:08 +0000)
commit40cc93a81b06bb6feac483a2a987c98dfef06c75
tree883b46d28c5198f76ab707650dc19166c3e8d113
parent7bdd20d0e92f9774adb8066c23a24868a42feb9b
Heap-use-after-free in WebCore::RenderLayerModelObject::hasSelfPaintingLayer
https://bugs.webkit.org/show_bug.cgi?id=116626

Patch by Bem Jones-Bey <bjonesbe@adobe.com> on 2013-05-22
Reviewed by David Hyatt.

This is a port of a Blink bug fix by Emil Eklund.

Account for saturated estimated position in RenderBlock::layoutBlockChild.

If the estimated top position is saturated the comparison with oldLogicalTop
might yield a false negative as adding and removing margins, borders etc from
a saturated number might yield incorrect results. If this is the case always
mark for layout.

Minimal test case impractical. See bug for raw fuzzer test case.

* platform/LayoutUnit.h:
(WebCore::LayoutUnit::mightBeSaturated): Add helper method for checking whether
    a number might be saturated.
* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::layoutBlockChild): Check if logicalTopEstimate is likely
    to be saturated and if so mark for layout.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@150544 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Source/WebCore/ChangeLog
Source/WebCore/platform/LayoutUnit.h
Source/WebCore/rendering/RenderBlock.cpp