2011-02-03 Abhishek Arya <inferno@chromium.org>
authorinferno@chromium.org <inferno@chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 4 Feb 2011 00:51:12 +0000 (00:51 +0000)
committerinferno@chromium.org <inferno@chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 4 Feb 2011 00:51:12 +0000 (00:51 +0000)
commit913a6e801b796bef592f79d609a9c7c38812eef6
tree36bf257ac749486da3f251370cd009aa87b590a6
parent7afc6e0173b6bd440d9420e244108ae42442c2c2
2011-02-03  Abhishek Arya  <inferno@chromium.org>

        Reviewed by James Robinson.

        Tests that we do not crash when overflowing the height of a root
        inline box.
        https://bugs.webkit.org/show_bug.cgi?id=53729

        * fast/overflow/overflow-height-float-not-removed-crash-expected.txt: Added.
        * fast/overflow/overflow-height-float-not-removed-crash.html: Added.
2011-02-03  Abhishek Arya  <inferno@chromium.org>

        Reviewed by James Robinson.

        Enforce more limits on root inline boxes height calculations.
        https://bugs.webkit.org/show_bug.cgi?id=53729

        Test: fast/overflow/overflow-height-float-not-removed-crash.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::removeFloatingObject): prevent logicalBottom to
        become negative when logicalTop is INT_MAX.
        (WebCore::RenderBlock::markLinesDirtyInBlockRange): when logicalBottom
        is INT_MAX, we should dirty everything. So, we bail out to make
        afterLowest equal to the lastRootBox() or lowestDirstLine.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@77565 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/fast/overflow/overflow-height-float-not-removed-crash-expected.txt [new file with mode: 0644]
LayoutTests/fast/overflow/overflow-height-float-not-removed-crash.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/rendering/RenderBlock.cpp