Title: [116698] trunk
- Revision
- 116698
- Author
- [email protected]
- Date
- 2012-05-10 16:02:00 -0700 (Thu, 10 May 2012)
Log Message
Crash in FontCache::releaseFontData due to infinite float size.
https://bugs.webkit.org/show_bug.cgi?id=86110
Reviewed by Andreas Kling.
Source/WebCore:
New callers always forget to clamp the font size, which overflows
to infinity on multiplication. It is best to clamp it at the end
to avoid getting greater than std::numeric_limits<float>::max().
Test: fast/css/large-font-size-crash.html
* platform/graphics/FontDescription.h:
(WebCore::FontDescription::setComputedSize):
(WebCore::FontDescription::setSpecifiedSize):
LayoutTests:
* fast/css/large-font-size-crash-expected.txt: Added.
* fast/css/large-font-size-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (116697 => 116698)
--- trunk/LayoutTests/ChangeLog 2012-05-10 22:58:28 UTC (rev 116697)
+++ trunk/LayoutTests/ChangeLog 2012-05-10 23:02:00 UTC (rev 116698)
@@ -1,3 +1,13 @@
+2012-05-10 Abhishek Arya <[email protected]>
+
+ Crash in FontCache::releaseFontData due to infinite float size.
+ https://bugs.webkit.org/show_bug.cgi?id=86110
+
+ Reviewed by Andreas Kling.
+
+ * fast/css/large-font-size-crash-expected.txt: Added.
+ * fast/css/large-font-size-crash.html: Added.
+
2012-05-10 Eric Seidel <[email protected]>
Make IFRAME_SEAMLESS child documents inherit styles from their parent iframe element
Added: trunk/LayoutTests/fast/css/large-font-size-crash-expected.txt (0 => 116698)
--- trunk/LayoutTests/fast/css/large-font-size-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/css/large-font-size-crash-expected.txt 2012-05-10 23:02:00 UTC (rev 116698)
@@ -0,0 +1 @@
+PASS. WebKit didn't crash.
Added: trunk/LayoutTests/fast/css/large-font-size-crash.html (0 => 116698)
--- trunk/LayoutTests/fast/css/large-font-size-crash.html (rev 0)
+++ trunk/LayoutTests/fast/css/large-font-size-crash.html 2012-05-10 23:02:00 UTC (rev 116698)
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<body style='font: 9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999in Ahem;'>
+PASS. WebKit didn't crash.
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+</script>
+</body>
+</html>
Property changes on: trunk/LayoutTests/fast/css/large-font-size-crash.html
___________________________________________________________________
Added: svn:executable
Modified: trunk/Source/WebCore/ChangeLog (116697 => 116698)
--- trunk/Source/WebCore/ChangeLog 2012-05-10 22:58:28 UTC (rev 116697)
+++ trunk/Source/WebCore/ChangeLog 2012-05-10 23:02:00 UTC (rev 116698)
@@ -1,3 +1,20 @@
+2012-05-10 Abhishek Arya <[email protected]>
+
+ Crash in FontCache::releaseFontData due to infinite float size.
+ https://bugs.webkit.org/show_bug.cgi?id=86110
+
+ Reviewed by Andreas Kling.
+
+ New callers always forget to clamp the font size, which overflows
+ to infinity on multiplication. It is best to clamp it at the end
+ to avoid getting greater than std::numeric_limits<float>::max().
+
+ Test: fast/css/large-font-size-crash.html
+
+ * platform/graphics/FontDescription.h:
+ (WebCore::FontDescription::setComputedSize):
+ (WebCore::FontDescription::setSpecifiedSize):
+
2012-05-10 Beth Dakin <[email protected]>
https://bugs.webkit.org/show_bug.cgi?id=82131
Modified: trunk/Source/WebCore/platform/graphics/FontDescription.h (116697 => 116698)
--- trunk/Source/WebCore/platform/graphics/FontDescription.h 2012-05-10 22:58:28 UTC (rev 116697)
+++ trunk/Source/WebCore/platform/graphics/FontDescription.h 2012-05-10 23:02:00 UTC (rev 116698)
@@ -138,8 +138,8 @@
FontDescription makeNormalFeatureSettings() const;
void setFamily(const FontFamily& family) { m_familyList = family; }
- void setComputedSize(float s) { ASSERT(isfinite(s)); m_computedSize = s; }
- void setSpecifiedSize(float s) { ASSERT(isfinite(s)); m_specifiedSize = s; }
+ void setComputedSize(float s) { m_computedSize = clampToFloat(s); }
+ void setSpecifiedSize(float s) { m_specifiedSize = clampToFloat(s); }
void setItalic(FontItalic i) { m_italic = i; }
void setItalic(bool i) { setItalic(i ? FontItalicOn : FontItalicOff); }
void setSmallCaps(FontSmallCaps c) { m_smallCaps = c; }
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
