LayoutTests:

        Reviewed by Maciej.

        - another large rowspan test case

        * fast/table/large-rowspan-crash-expected.txt: Added.
        * fast/table/large-rowspan-crash.html: Added.

WebCore:

        Reviewed by Maciej.

        - fix http://bugzilla.opendarwin.org/show_bug.cgi?id=9806
          <rdar://problem/4622622>
          REGRESSION: Large rowspan causes WebKit to call abort()

        Test: fast/table/large-rowspan-crash.html

        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::ensureRows):
        Use sizeof(RowStruct) instead of sizeof(int).
        Clearly we'll need something better to solve this completely.
        I expect another smaller, but still huge, value will still cause a problem.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@15390 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index a7ac886b3a76c5c92a0699c14413bcbe3fe15bf6..0241183344399764cff45bb91d13e00cd9b2d021 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,12 @@
+2006-07-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - another large rowspan test case
+
+        * fast/table/large-rowspan-crash-expected.txt: Added.
+        * fast/table/large-rowspan-crash.html: Added.
+
 2006-07-12  Anders Carlsson  <acarlsson@apple.com>
 
         Reviewed by Maciej.

diff --git a/LayoutTests/fast/table/large-rowspan-crash-expected.txt b/LayoutTests/fast/table/large-rowspan-crash-expected.txt
new file mode 100644 (file)
index 0000000..08d17fb
--- /dev/null
+++ b/LayoutTests/fast/table/large-rowspan-crash-expected.txt
@@ -0,0 +1,9 @@
+If the browser didn't crash, the test passed.
+
+
+
+Property changes on: LayoutTests/fast/table/large-rowspan-crash-expected.txt
+___________________________________________________________________
+Name: svn:eol-style
+   + native
+

diff --git a/LayoutTests/fast/table/large-rowspan-crash.html b/LayoutTests/fast/table/large-rowspan-crash.html
new file mode 100644 (file)
index 0000000..8135201
--- /dev/null
+++ b/LayoutTests/fast/table/large-rowspan-crash.html
@@ -0,0 +1,14 @@
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+</script>
+<table><td rowspan=674227123></td></table>
+<p>If the browser didn't crash, the test passed.</p>
+
+Property changes on: LayoutTests/fast/table/large-rowspan-crash.html
+___________________________________________________________________
+Name: svn:mime-type
+   + text/html
+Name: svn:eol-style
+   + native
+

diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index fda4f6dc1348fa1ba72c355b555da25240b501a5..94b04a4fe5d2757100c7a4469bc4699816992bcd 100644 (file)
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,19 @@
+2006-07-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - fix http://bugzilla.opendarwin.org/show_bug.cgi?id=9806
+          <rdar://problem/4622622>
+          REGRESSION: Large rowspan causes WebKit to call abort()
+
+        Test: fast/table/large-rowspan-crash.html
+
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::ensureRows):
+        Use sizeof(RowStruct) instead of sizeof(int).
+        Clearly we'll need something better to solve this completely.
+        I expect another smaller, but still huge, value will still cause a problem.
+
 2006-07-12  Anders Carlsson  <acarlsson@apple.com>
 
         Reviewed by Maciej.

diff --git a/WebCore/rendering/RenderTableSection.cpp b/WebCore/rendering/RenderTableSection.cpp
index d5bb46aeac2b3126db3fa42b8f1da5ba5691ed25..e7f6b8de3e8e280f83b084fad3ce746ec4ed66aa 100644 (file)
--- a/WebCore/rendering/RenderTableSection.cpp
+++ b/WebCore/rendering/RenderTableSection.cpp
@@ -145,7 +145,7 @@ bool RenderTableSection::ensureRows(int numRows)
     int nRows = gridRows;
     if (numRows > nRows) {
         if (numRows > static_cast<int>(grid.size())) {
-            if (numRows > static_cast<int>(numeric_limits<size_t>::max() / sizeof(int)))
+            if (numRows > static_cast<int>(numeric_limits<size_t>::max() / sizeof(RowStruct)))
                 return false;
             grid.resize(numRows);
         }