Title: [167580] trunk
- Revision
- 167580
- Author
- [email protected]
- Date
- 2014-04-20 21:40:11 -0700 (Sun, 20 Apr 2014)
Log Message
Simple layout can get confused by coordinate overflow
https://bugs.webkit.org/show_bug.cgi?id=131890
rdar://problem/15558510
Reviewed by Andreas Kling.
Source/WebCore:
Test: fast/css/simple-layout-overflow.html
* rendering/SimpleLineLayoutResolver.h:
(WebCore::SimpleLineLayout::RunResolver::rangeForRect):
If lastLine is smaller than firstList, just ignore it.
LayoutTests:
* fast/css/simple-layout-overflow-expected.txt: Added.
* fast/css/simple-layout-overflow.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (167579 => 167580)
--- trunk/LayoutTests/ChangeLog 2014-04-21 04:39:11 UTC (rev 167579)
+++ trunk/LayoutTests/ChangeLog 2014-04-21 04:40:11 UTC (rev 167580)
@@ -1,3 +1,14 @@
+2014-04-19 Darin Adler <[email protected]>
+
+ Simple layout can get confused by coordinate overflow
+ https://bugs.webkit.org/show_bug.cgi?id=131890
+ rdar://problem/15558510
+
+ Reviewed by Andreas Kling.
+
+ * fast/css/simple-layout-overflow-expected.txt: Added.
+ * fast/css/simple-layout-overflow.html: Added.
+
2014-04-19 Alexey Proskuryakov <[email protected]>
Crashes in HTMLFormElement::submit.
Added: trunk/LayoutTests/fast/css/simple-layout-overflow-expected.txt (0 => 167580)
--- trunk/LayoutTests/fast/css/simple-layout-overflow-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/css/simple-layout-overflow-expected.txt 2014-04-21 04:40:11 UTC (rev 167580)
@@ -0,0 +1,3 @@
+Test passes if it doesn't hit an assertion or crash. a
+b
+-_
Property changes on: trunk/LayoutTests/fast/css/simple-layout-overflow-expected.txt
___________________________________________________________________
Added: svn:eol-style
Added: trunk/LayoutTests/fast/css/simple-layout-overflow.html (0 => 167580)
--- trunk/LayoutTests/fast/css/simple-layout-overflow.html (rev 0)
+++ trunk/LayoutTests/fast/css/simple-layout-overflow.html 2014-04-21 04:40:11 UTC (rev 167580)
@@ -0,0 +1,16 @@
+<style>
+p { margin: 5px 1em; width: 0; }
+* { padding-top: 1073741824rem; }
+:first-of-type { position: fixed; }
+</style>
+<p id="a">a</p>
+<p id="b">b</p>
+<p id="c">-_</p>
+Test passes if it doesn't hit an assertion or crash.
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+document.body.parentNode.appendChild(document.getElementById("a"));
+document.body.parentNode.appendChild(document.getElementById("b"));
+document.body.parentNode.appendChild(document.getElementById("c"));
+</script>
Property changes on: trunk/LayoutTests/fast/css/simple-layout-overflow.html
___________________________________________________________________
Added: svn:mime-type
Added: svn:eol-style
Modified: trunk/Source/WebCore/ChangeLog (167579 => 167580)
--- trunk/Source/WebCore/ChangeLog 2014-04-21 04:39:11 UTC (rev 167579)
+++ trunk/Source/WebCore/ChangeLog 2014-04-21 04:40:11 UTC (rev 167580)
@@ -1,3 +1,17 @@
+2014-04-19 Darin Adler <[email protected]>
+
+ Simple layout can get confused by coordinate overflow
+ https://bugs.webkit.org/show_bug.cgi?id=131890
+ rdar://problem/15558510
+
+ Reviewed by Andreas Kling.
+
+ Test: fast/css/simple-layout-overflow.html
+
+ * rendering/SimpleLineLayoutResolver.h:
+ (WebCore::SimpleLineLayout::RunResolver::rangeForRect):
+ If lastLine is smaller than firstList, just ignore it.
+
2014-04-20 Darin Adler <[email protected]>
ScriptExecutionContext::stopActiveDOMObjects iterates a hash map that can change during iteration (for multiple reasons, including GC)
Modified: trunk/Source/WebCore/rendering/SimpleLineLayoutResolver.h (167579 => 167580)
--- trunk/Source/WebCore/rendering/SimpleLineLayoutResolver.h 2014-04-21 04:39:11 UTC (rev 167579)
+++ trunk/Source/WebCore/rendering/SimpleLineLayoutResolver.h 2014-04-21 04:40:11 UTC (rev 167580)
@@ -283,12 +283,13 @@
return Range<Iterator>(begin(), end());
unsigned firstLine = lineIndexForHeight(rect.y());
- unsigned lastLine = lineIndexForHeight(rect.maxY());
+ unsigned lastLine = std::max(firstLine, lineIndexForHeight(rect.maxY()));
auto rangeBegin = begin().advanceLines(firstLine);
if (rangeBegin == end())
return Range<Iterator>(end(), end());
auto rangeEnd = rangeBegin;
+ ASSERT(lastLine >= firstLine);
rangeEnd.advanceLines(lastLine - firstLine + 1);
return Range<Iterator>(rangeBegin, rangeEnd);
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
