- Revision
- 202489
- Author
- [email protected]
- Date
- 2016-06-27 10:36:09 -0700 (Mon, 27 Jun 2016)
Log Message
Set an upper limit for the size or number of pieces of stretchy operators
https://bugs.webkit.org/show_bug.cgi?id=155434
Source/WebCore:
Patch by Frederic Wang <[email protected]> on 2016-06-27
Reviewed by Brent Fulgham.
Stretchy MathML operators can currently use an arbitrary number of extension glyphs to cover
a target size. This may result in hangs if large stretch sizes are requested. This change
only allow at most the 128 first extensions to be painted by the MathOperator class, which
should really be enough for mathematical formulas used in practice.
No new tests, already tested by very-large-stretchy-operators.
* rendering/mathml/MathOperator.cpp: Add a new kMaximumExtensionCount constant.
(WebCore::MathOperator::fillWithVerticalExtensionGlyph): Limit the number of step in this loop to kMaximumExtensionCount.
(WebCore::MathOperator::fillWithHorizontalExtensionGlyph): Ditto.
LayoutTests:
Update test expectations for very-large-stretchy-operators.
Patch by Frederic Wang <[email protected]> on 2016-06-27
Reviewed by Brent Fulgham.
* platform/efl/TestExpectations:
* platform/gtk/TestExpectations:
* platform/ios-simulator/TestExpectations:
* platform/mac/TestExpectations:
* platform/win/TestExpectations:
Modified Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (202488 => 202489)
--- trunk/LayoutTests/ChangeLog 2016-06-27 17:33:38 UTC (rev 202488)
+++ trunk/LayoutTests/ChangeLog 2016-06-27 17:36:09 UTC (rev 202489)
@@ -1,3 +1,18 @@
+2016-06-27 Frederic Wang <[email protected]>
+
+ Set an upper limit for the size or number of pieces of stretchy operators
+ https://bugs.webkit.org/show_bug.cgi?id=155434
+
+ Update test expectations for very-large-stretchy-operators.
+
+ Reviewed by Brent Fulgham.
+
+ * platform/efl/TestExpectations:
+ * platform/gtk/TestExpectations:
+ * platform/ios-simulator/TestExpectations:
+ * platform/mac/TestExpectations:
+ * platform/win/TestExpectations:
+
2016-06-27 Ryan Haddad <[email protected]>
Skip two LayoutTests that rely on mouse events on ios-simulator
Modified: trunk/LayoutTests/platform/efl/TestExpectations (202488 => 202489)
--- trunk/LayoutTests/platform/efl/TestExpectations 2016-06-27 17:33:38 UTC (rev 202488)
+++ trunk/LayoutTests/platform/efl/TestExpectations 2016-06-27 17:36:09 UTC (rev 202489)
@@ -762,8 +762,6 @@
webkit.org/b/136099 fast/events/scroll-event-during-modal-dialog.html [ Crash Timeout ]
webkit.org/b/136099 fast/harness/show-modal-dialog.html [ Crash Timeout ]
-webkit.org/b/136227 mathml/very-large-stretchy-operators.html [ Crash Timeout Pass ]
-
#webkit.org/b/142158 inspector/dom/remove-multiple-nodes.html [ Crash Pass ]
#webkit.org/b/147018 inspector/css/get-system-fonts.html [ Skip ]
Modified: trunk/LayoutTests/platform/gtk/TestExpectations (202488 => 202489)
--- trunk/LayoutTests/platform/gtk/TestExpectations 2016-06-27 17:33:38 UTC (rev 202488)
+++ trunk/LayoutTests/platform/gtk/TestExpectations 2016-06-27 17:36:09 UTC (rev 202489)
@@ -1607,7 +1607,6 @@
webkit.org/b/141835 media/video-controls-no-scripting.html [ Failure ]
# May take too long on the bots.
-Bug(GTK) mathml/very-large-stretchy-operators.html [ Pass Timeout ]
Bug(GTK) fast/history/go-back-to-iframe-with-plugin.html [ Timeout Pass ]
Modified: trunk/LayoutTests/platform/ios-simulator/TestExpectations (202488 => 202489)
--- trunk/LayoutTests/platform/ios-simulator/TestExpectations 2016-06-27 17:33:38 UTC (rev 202488)
+++ trunk/LayoutTests/platform/ios-simulator/TestExpectations 2016-06-27 17:36:09 UTC (rev 202489)
@@ -2950,8 +2950,6 @@
webkit.org/b/155339 [ Debug ] imported/blink/fast/multicol/dynamic/multicol-with-abspos-svg-with-foreignobject-with-multicol-crash.html [ Pass Crash ]
webkit.org/b/155339 [ Debug ] imported/blink/fast/multicol/dynamic/relayout-abspos-in-relpos-spanner.html [ Pass Crash ]
-webkit.org/b/155565 [ Debug ] mathml/very-large-stretchy-operators.html [ Skip ]
-
# RTL Scrollbars are not implemented on iOS.
fast/scrolling/rtl-scrollbars-sticky-document-2.html [ ImageOnlyFailure ]
fast/scrolling/rtl-scrollbars-sticky-document.html [ ImageOnlyFailure ]
Modified: trunk/LayoutTests/platform/mac/TestExpectations (202488 => 202489)
--- trunk/LayoutTests/platform/mac/TestExpectations 2016-06-27 17:33:38 UTC (rev 202488)
+++ trunk/LayoutTests/platform/mac/TestExpectations 2016-06-27 17:36:09 UTC (rev 202489)
@@ -729,11 +729,6 @@
webkit.org/b/122038 animations/transform-non-accelerated.html [ Pass Failure ]
-webkit.org/b/122490 [ Debug ] mathml/very-large-stretchy-operators.html [ Skip ]
-
-# rdar://problem/21443002
-[ Release ElCapitan+ ] mathml/very-large-stretchy-operators.html [ Slow ]
-
webkit.org/b/123220 compositing/regions/floated-region-with-transformed-child.html [ Pass ImageOnlyFailure ]
webkit.org/b/138179 compositing/regions/propagate-region-box-shadow-border-padding-for-video.html [ Skip ]
Modified: trunk/LayoutTests/platform/win/TestExpectations (202488 => 202489)
--- trunk/LayoutTests/platform/win/TestExpectations 2016-06-27 17:33:38 UTC (rev 202488)
+++ trunk/LayoutTests/platform/win/TestExpectations 2016-06-27 17:36:09 UTC (rev 202489)
@@ -1964,7 +1964,6 @@
mathml/opentype/opentype-stretchy-horizontal.html [ Skip ] # Crashing
mathml/presentation/style-changed.html [ Crash Pass ]
webkit.org/b/140522 mathml/opentype/munderover-layout-resize.html [ Skip ] # Crashing
-mathml/very-large-stretchy-operators.html [ Skip ]
################################################################################
################# End MathML Issues ####################
################################################################################
Modified: trunk/Source/WebCore/ChangeLog (202488 => 202489)
--- trunk/Source/WebCore/ChangeLog 2016-06-27 17:33:38 UTC (rev 202488)
+++ trunk/Source/WebCore/ChangeLog 2016-06-27 17:36:09 UTC (rev 202489)
@@ -1,3 +1,21 @@
+2016-06-27 Frederic Wang <[email protected]>
+
+ Set an upper limit for the size or number of pieces of stretchy operators
+ https://bugs.webkit.org/show_bug.cgi?id=155434
+
+ Reviewed by Brent Fulgham.
+
+ Stretchy MathML operators can currently use an arbitrary number of extension glyphs to cover
+ a target size. This may result in hangs if large stretch sizes are requested. This change
+ only allow at most the 128 first extensions to be painted by the MathOperator class, which
+ should really be enough for mathematical formulas used in practice.
+
+ No new tests, already tested by very-large-stretchy-operators.
+
+ * rendering/mathml/MathOperator.cpp: Add a new kMaximumExtensionCount constant.
+ (WebCore::MathOperator::fillWithVerticalExtensionGlyph): Limit the number of step in this loop to kMaximumExtensionCount.
+ (WebCore::MathOperator::fillWithHorizontalExtensionGlyph): Ditto.
+
2016-06-27 Frederic Wang <[email protected]>
Small refactoring MathMLInlineContainerElement::createElementRenderer
Modified: trunk/Source/WebCore/rendering/mathml/MathOperator.cpp (202488 => 202489)
--- trunk/Source/WebCore/rendering/mathml/MathOperator.cpp 2016-06-27 17:33:38 UTC (rev 202488)
+++ trunk/Source/WebCore/rendering/mathml/MathOperator.cpp 2016-06-27 17:36:09 UTC (rev 202489)
@@ -32,6 +32,7 @@
#include "StyleInheritedData.h"
static const unsigned kRadicalOperator = 0x221A;
+static const unsigned kMaximumExtensionCount = 128;
namespace WebCore {
@@ -490,9 +491,8 @@
LayoutPoint glyphOrigin = LayoutPoint(from.x(), from.y() - offsetToGlyphTop);
FloatRect lastPaintedGlyphRect(from, FloatSize());
- // FIXME: In practice, only small stretch sizes are requested but we may need to limit the number
- // of pieces that can be repeated to avoid hangs. See http://webkit.org/b/155434
- while (lastPaintedGlyphRect.maxY() < to.y()) {
+ // In practice, only small stretch sizes are requested but we limit the number of glyphs to avoid hangs.
+ for (unsigned extensionCount = 0; lastPaintedGlyphRect.maxY() < to.y() && extensionCount < kMaximumExtensionCount; extensionCount++) {
lastPaintedGlyphRect = paintGlyph(style, info, m_assembly.extension, glyphOrigin, TrimTopAndBottom);
glyphOrigin.setY(glyphOrigin.y() + lastPaintedGlyphRect.height());
@@ -529,9 +529,8 @@
LayoutPoint glyphOrigin = LayoutPoint(from.x() + offsetToGlyphLeft, from.y());
FloatRect lastPaintedGlyphRect(from, FloatSize());
- // FIXME: In practice, only small stretch sizes are requested but we may need to limit the number
- // of pieces that can be repeated to avoid hangs. See http://webkit.org/b/155434
- while (lastPaintedGlyphRect.maxX() < to.x()) {
+ // In practice, only small stretch sizes are requested but we limit the number of glyphs to avoid hangs.
+ for (unsigned extensionCount = 0; lastPaintedGlyphRect.maxX() < to.x() && extensionCount < kMaximumExtensionCount; extensionCount++) {
lastPaintedGlyphRect = paintGlyph(style, info, m_assembly.extension, glyphOrigin, TrimLeftAndRight);
glyphOrigin.setX(glyphOrigin.x() + lastPaintedGlyphRect.width());
