2011-02-03 Abhishek Arya <inferno@chromium.org>

2011-02-03  Abhishek Arya  <inferno@chromium.org>

        Reviewed by James Robinson.

        Tests that we do not crash when overflowing the height of a root
        inline box.
        https://bugs.webkit.org/show_bug.cgi?id=53729

        * fast/overflow/overflow-height-float-not-removed-crash-expected.txt: Added.
        * fast/overflow/overflow-height-float-not-removed-crash.html: Added.
2011-02-03  Abhishek Arya  <inferno@chromium.org>

        Reviewed by James Robinson.

        Enforce more limits on root inline boxes height calculations.
        https://bugs.webkit.org/show_bug.cgi?id=53729

        Test: fast/overflow/overflow-height-float-not-removed-crash.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::removeFloatingObject): prevent logicalBottom to
        become negative when logicalTop is INT_MAX.
        (WebCore::RenderBlock::markLinesDirtyInBlockRange): when logicalBottom
        is INT_MAX, we should dirty everything. So, we bail out to make
        afterLowest equal to the lastRootBox() or lowestDirstLine.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@77565 268f45cc-cd09-0410-ab3c-d52691b4dbfc