Title: [184088] releases/WebKitGTK/webkit-2.8
- Revision
- 184088
- Author
- [email protected]
- Date
- 2015-05-11 06:08:11 -0700 (Mon, 11 May 2015)
Log Message
Merge r182974 - Large values for line-height cause integer overflow in RenderStyle::computedLineHeight
https://bugs.webkit.org/show_bug.cgi?id=143863
Reviewed by Rob Buis.
Source/WebCore:
When we compute huge values for line-height through percentage or CSS
calc, we'll overflow the integer and later on
ShapeOutsideInfo::computeDeltasForContainingBlockLine will ASSERT
because it expects non-negative line height. So for the computed
line-height, clamp to an integer range to avoid overflow. Note that
the code path for percentages here is safe because LayoutUnit clamps
to an int on conversion.
This is based on a Blink patch by Rob Buis.
Test: fast/shapes/shape-outside-floats/shape-outside-negative-line-height-crash.html
* rendering/style/RenderStyle.cpp:
(WebCore::RenderStyle::computedLineHeight): Clamp line-height to an
int to avoid overflow.
LayoutTests:
Simplified test from a fuzzer.
* fast/shapes/shape-outside-floats/shape-outside-negative-line-height-crash-expected.txt: Added.
* fast/shapes/shape-outside-floats/shape-outside-negative-line-height-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: releases/WebKitGTK/webkit-2.8/LayoutTests/ChangeLog (184087 => 184088)
--- releases/WebKitGTK/webkit-2.8/LayoutTests/ChangeLog 2015-05-11 13:05:22 UTC (rev 184087)
+++ releases/WebKitGTK/webkit-2.8/LayoutTests/ChangeLog 2015-05-11 13:08:11 UTC (rev 184088)
@@ -1,3 +1,15 @@
+2015-04-17 Bem Jones-Bey <[email protected]>
+
+ Large values for line-height cause integer overflow in RenderStyle::computedLineHeight
+ https://bugs.webkit.org/show_bug.cgi?id=143863
+
+ Reviewed by Rob Buis.
+
+ Simplified test from a fuzzer.
+
+ * fast/shapes/shape-outside-floats/shape-outside-negative-line-height-crash-expected.txt: Added.
+ * fast/shapes/shape-outside-floats/shape-outside-negative-line-height-crash.html: Added.
+
2015-04-15 Jordan Harband <[email protected]>
String.prototype.startsWith/endsWith/includes have wrong length in r182673
Added: releases/WebKitGTK/webkit-2.8/LayoutTests/fast/shapes/shape-outside-floats/shape-outside-negative-line-height-crash-expected.txt (0 => 184088)
--- releases/WebKitGTK/webkit-2.8/LayoutTests/fast/shapes/shape-outside-floats/shape-outside-negative-line-height-crash-expected.txt (rev 0)
+++ releases/WebKitGTK/webkit-2.8/LayoutTests/fast/shapes/shape-outside-floats/shape-outside-negative-line-height-crash-expected.txt 2015-05-11 13:08:11 UTC (rev 184088)
@@ -0,0 +1 @@
+This test passes if it doesn't crash.
Added: releases/WebKitGTK/webkit-2.8/LayoutTests/fast/shapes/shape-outside-floats/shape-outside-negative-line-height-crash.html (0 => 184088)
--- releases/WebKitGTK/webkit-2.8/LayoutTests/fast/shapes/shape-outside-floats/shape-outside-negative-line-height-crash.html (rev 0)
+++ releases/WebKitGTK/webkit-2.8/LayoutTests/fast/shapes/shape-outside-floats/shape-outside-negative-line-height-crash.html 2015-05-11 13:08:11 UTC (rev 184088)
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<style>
+body {
+ font: calc( 10000 * 1000% )/calc( 10000 * 1000% ) sans-serif;
+}
+p {
+ -webkit-shape-outside: circle();
+ float: right;
+}
+</style>
+<body>
+ <p>This test passes if it doesn't crash.</p>
+</body>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+</script>
Modified: releases/WebKitGTK/webkit-2.8/Source/WebCore/ChangeLog (184087 => 184088)
--- releases/WebKitGTK/webkit-2.8/Source/WebCore/ChangeLog 2015-05-11 13:05:22 UTC (rev 184087)
+++ releases/WebKitGTK/webkit-2.8/Source/WebCore/ChangeLog 2015-05-11 13:08:11 UTC (rev 184088)
@@ -1,3 +1,26 @@
+2015-04-17 Bem Jones-Bey <[email protected]>
+
+ Large values for line-height cause integer overflow in RenderStyle::computedLineHeight
+ https://bugs.webkit.org/show_bug.cgi?id=143863
+
+ Reviewed by Rob Buis.
+
+ When we compute huge values for line-height through percentage or CSS
+ calc, we'll overflow the integer and later on
+ ShapeOutsideInfo::computeDeltasForContainingBlockLine will ASSERT
+ because it expects non-negative line height. So for the computed
+ line-height, clamp to an integer range to avoid overflow. Note that
+ the code path for percentages here is safe because LayoutUnit clamps
+ to an int on conversion.
+
+ This is based on a Blink patch by Rob Buis.
+
+ Test: fast/shapes/shape-outside-floats/shape-outside-negative-line-height-crash.html
+
+ * rendering/style/RenderStyle.cpp:
+ (WebCore::RenderStyle::computedLineHeight): Clamp line-height to an
+ int to avoid overflow.
+
2015-04-17 Zalan Bujtas <[email protected]>
RenderTableCell::computeCollapsed*Border() should check if the cell is still attached to the render tree.
Modified: releases/WebKitGTK/webkit-2.8/Source/WebCore/rendering/style/RenderStyle.cpp (184087 => 184088)
--- releases/WebKitGTK/webkit-2.8/Source/WebCore/rendering/style/RenderStyle.cpp 2015-05-11 13:05:22 UTC (rev 184087)
+++ releases/WebKitGTK/webkit-2.8/Source/WebCore/rendering/style/RenderStyle.cpp 2015-05-11 13:08:11 UTC (rev 184088)
@@ -1396,7 +1396,7 @@
if (lh.isPercent())
return minimumValueForLength(lh, fontSize());
- return lh.value();
+ return clampTo<int>(lh.value());
}
void RenderStyle::setWordSpacing(Length value)
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
