2011-02-03 Abhishek Arya <inferno@chromium.org>
authorinferno@chromium.org <inferno@chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 4 Feb 2011 00:51:12 +0000 (00:51 +0000)
committerinferno@chromium.org <inferno@chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 4 Feb 2011 00:51:12 +0000 (00:51 +0000)
        Reviewed by James Robinson.

        Tests that we do not crash when overflowing the height of a root
        inline box.
        https://bugs.webkit.org/show_bug.cgi?id=53729

        * fast/overflow/overflow-height-float-not-removed-crash-expected.txt: Added.
        * fast/overflow/overflow-height-float-not-removed-crash.html: Added.
2011-02-03  Abhishek Arya  <inferno@chromium.org>

        Reviewed by James Robinson.

        Enforce more limits on root inline boxes height calculations.
        https://bugs.webkit.org/show_bug.cgi?id=53729

        Test: fast/overflow/overflow-height-float-not-removed-crash.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::removeFloatingObject): prevent logicalBottom to
        become negative when logicalTop is INT_MAX.
        (WebCore::RenderBlock::markLinesDirtyInBlockRange): when logicalBottom
        is INT_MAX, we should dirty everything. So, we bail out to make
        afterLowest equal to the lastRootBox() or lowestDirstLine.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@77565 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/fast/overflow/overflow-height-float-not-removed-crash-expected.txt [new file with mode: 0644]
LayoutTests/fast/overflow/overflow-height-float-not-removed-crash.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/rendering/RenderBlock.cpp

index 8734a27f87b593ff40f3852fc8d8e41007204cda..053190e0f298f56ba8c67335b968d1b5d2c01ecf 100644 (file)
@@ -1,3 +1,14 @@
+2011-02-03  Abhishek Arya  <inferno@chromium.org>
+
+        Reviewed by James Robinson.
+
+        Tests that we do not crash when overflowing the height of a root
+        inline box.        
+        https://bugs.webkit.org/show_bug.cgi?id=53729
+
+        * fast/overflow/overflow-height-float-not-removed-crash-expected.txt: Added.
+        * fast/overflow/overflow-height-float-not-removed-crash.html: Added.
+
 2011-02-03  David Levin  <levin@chromium.org>
 
         Reviewed by Adam Barth.
diff --git a/LayoutTests/fast/overflow/overflow-height-float-not-removed-crash-expected.txt b/LayoutTests/fast/overflow/overflow-height-float-not-removed-crash-expected.txt
new file mode 100644 (file)
index 0000000..a700cb6
--- /dev/null
@@ -0,0 +1,2 @@
+PASS
diff --git a/LayoutTests/fast/overflow/overflow-height-float-not-removed-crash.html b/LayoutTests/fast/overflow/overflow-height-float-not-removed-crash.html
new file mode 100644 (file)
index 0000000..e736b05
--- /dev/null
@@ -0,0 +1,20 @@
+<html>\r
+    <head>\r
+        <script>\r
+            if (window.layoutTestController)\r
+                layoutTestController.dumpAsText();\r
+            \r
+            function finish()\r
+            {\r
+                document.getElementById("result").innerHTML = "PASS";\r
+            } \r
+        </script>\r
+    </head>\r
+    <body onload="finish()">\r
+        <div id="result"></div>\r
+        <textarea rows="100000000"></textarea>\r
+        <textarea style="width: 100%" rows="100000000"></textarea>\r
+        <object data="a" align="right"></object>\r
+    </body>\r
+</html>\r
+\r
index bbf143fec225a9476dd9fa95442f15952f1d7a06..6d66d06576982dd9e5ba98e332e159badafc446d 100644 (file)
@@ -1,3 +1,19 @@
+2011-02-03  Abhishek Arya  <inferno@chromium.org>
+
+        Reviewed by James Robinson.
+
+        Enforce more limits on root inline boxes height calculations.
+        https://bugs.webkit.org/show_bug.cgi?id=53729
+
+        Test: fast/overflow/overflow-height-float-not-removed-crash.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::removeFloatingObject): prevent logicalBottom to
+        become negative when logicalTop is INT_MAX.
+        (WebCore::RenderBlock::markLinesDirtyInBlockRange): when logicalBottom
+        is INT_MAX, we should dirty everything. So, we bail out to make
+        afterLowest equal to the lastRootBox() or lowestDirstLine.
+
 2011-02-03  David Levin  <levin@chromium.org>
 
         Reviewed by Adam Barth and Oliver Hunt.
index 8246de74459e9dc26ca056ea03f7fb5c8f06daf3..5383610171f6f01f8c9be3795d5469b5266f198c 100644 (file)
@@ -3106,7 +3106,7 @@ void RenderBlock::removeFloatingObject(RenderBox* o)
                     // Special-case zero- and less-than-zero-height floats: those don't touch
                     // the line that they're on, but it still needs to be dirtied. This is
                     // accomplished by pretending they have a height of 1.
-                    logicalBottom = max(logicalBottom, logicalTop + 1);
+                    logicalBottom = max(logicalBottom, max(logicalTop + 1, logicalTop));
                     markLinesDirtyInBlockRange(0, logicalBottom);
                 }
                 m_floatingObjects->removeRef(it.current());
@@ -3468,7 +3468,7 @@ void RenderBlock::markLinesDirtyInBlockRange(int logicalTop, int logicalBottom,
 
     RootInlineBox* lowestDirtyLine = lastRootBox();
     RootInlineBox* afterLowest = lowestDirtyLine;
-    while (lowestDirtyLine && lowestDirtyLine->blockLogicalHeight() >= logicalBottom) {
+    while (lowestDirtyLine && lowestDirtyLine->blockLogicalHeight() >= logicalBottom && logicalBottom < numeric_limits<int>::max()) {
         afterLowest = lowestDirtyLine;
         lowestDirtyLine = lowestDirtyLine->prevRootBox();
     }