[SCM] WebKit Debian packaging branch, webkit-1.3, updated. upstream/1.3.7-4207-g178b198
mitz at apple.com
mitz at apple.com
Sun Feb 20 23:28:08 UTC 2011
The following commit has been merged in the webkit-1.3 branch:
commit d557175d80212c4d66a5d373ca931066ce81099a
Author: mitz at apple.com <mitz at apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date: Thu Jan 20 20:47:50 2011 +0000
<rdar://problem/8765498> REGRESSION (r72141): Cannot order prints with Aperture 3.1
Reviewed by Adele Peterson.
<rdar://problem/8884648> REGRESSION (r72141): Safari hangs when visiting a page on www.bfmtv.com
https://bugs.webkit.org/show_bug.cgi?id=52765
<rdar://problem/8890909> REGRESSION (r72141): Very Slow Rendering With Certain Markup
https://bugs.webkit.org/show_bug.cgi?id=52265
Source/WebCore:
Test: fast/block/line-layout/negative-max-height.html
Integer overflow detection led to a block having a huge height. This manifested as broken layout
in the first bug and as extreme slowness in the latter bugs because of
https://bugs.webkit.org/show_bug.cgi?id=52832
* rendering/RootInlineBox.cpp:
(WebCore::RootInlineBox::alignBoxesInBlockDirection): Clamp maxHeight to 0 so the next line
cannot start above this line. The negative maxHeight also caused the integer overflow detection
logic to give the block a huge height.
LayoutTests:
* fast/block/line-layout: Added.
* fast/block/line-layout/negative-max-height-expected.checksum: Added.
* fast/block/line-layout/negative-max-height-expected.png: Added.
* fast/block/line-layout/negative-max-height-expected.txt: Added.
* fast/block/line-layout/negative-max-height.html: Added.
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@76273 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index fc66b97..b11637e 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,21 @@
+2011-01-20 Dan Bernstein <mitz at apple.com>
+
+ Reviewed by Adele Peterson.
+
+ <rdar://problem/8765498> REGRESSION (r72141): Cannot order prints with Aperture 3.1
+
+ <rdar://problem/8884648> REGRESSION (r72141): Safari hangs when visiting a page on www.bfmtv.com
+ https://bugs.webkit.org/show_bug.cgi?id=52765
+
+ <rdar://problem/8890909> REGRESSION (r72141): Very Slow Rendering With Certain Markup
+ https://bugs.webkit.org/show_bug.cgi?id=52265
+
+ * fast/block/line-layout: Added.
+ * fast/block/line-layout/negative-max-height-expected.checksum: Added.
+ * fast/block/line-layout/negative-max-height-expected.png: Added.
+ * fast/block/line-layout/negative-max-height-expected.txt: Added.
+ * fast/block/line-layout/negative-max-height.html: Added.
+
2011-01-20 Ryosuke Niwa <rniwa at webkit.org>
Unreviewed Chromium rebaseline for r76236.
diff --git a/LayoutTests/fast/flexbox/block-axis-expected.checksum b/LayoutTests/fast/block/line-layout/negative-max-height-expected.checksum
similarity index 100%
copy from LayoutTests/fast/flexbox/block-axis-expected.checksum
copy to LayoutTests/fast/block/line-layout/negative-max-height-expected.checksum
diff --git a/LayoutTests/fast/block/line-layout/negative-max-height-expected.txt b/LayoutTests/fast/block/line-layout/negative-max-height-expected.txt
new file mode 100644
index 0000000..3efc035
--- /dev/null
+++ b/LayoutTests/fast/block/line-layout/negative-max-height-expected.txt
@@ -0,0 +1,13 @@
+layer at (0,0) size 800x600
+ RenderView at (0,0) size 800x600
+layer at (0,0) size 800x600 layerType: background only
+layer at (8,8) size 100x100
+ RenderBlock (positioned) zI: -1 {DIV} at (8,8) size 100x100 [bgcolor=#FF0000]
+layer at (0,0) size 800x600 layerType: foreground only
+ RenderBlock {HTML} at (0,0) size 800x600
+ RenderBody {BODY} at (8,8) size 784x584
+ RenderBlock {DIV} at (0,0) size 100x50 [bgcolor=#008000]
+ RenderBlock {DIV} at (0,50) size 784x0
+ RenderBlock {DIV} at (0,-25) size 20x20
+ RenderText {#text} at (0,0) size 0x0
+ RenderBlock {DIV} at (0,50) size 100x50 [bgcolor=#008000]
diff --git a/LayoutTests/fast/block/line-layout/negative-max-height.html b/LayoutTests/fast/block/line-layout/negative-max-height.html
new file mode 100644
index 0000000..18f1fb5
--- /dev/null
+++ b/LayoutTests/fast/block/line-layout/negative-max-height.html
@@ -0,0 +1,6 @@
+<div style="position: absolute; width: 100px; height: 100px; background-color: red; z-index: -1;"></div>
+<div style="height: 50px; background-color: green; width: 100px;"></div>
+<div id="target">
+ <div style="display: inline-block; width: 20px; height: 20px; margin-top: -25px;"></div>
+</div>
+<div style="height: 50px; background-color: green; width: 100px;"></div>
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 87de2a5..b1ed296 100644
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,26 @@
+2011-01-20 Dan Bernstein <mitz at apple.com>
+
+ Reviewed by Adele Peterson.
+
+ <rdar://problem/8765498> REGRESSION (r72141): Cannot order prints with Aperture 3.1
+
+ <rdar://problem/8884648> REGRESSION (r72141): Safari hangs when visiting a page on www.bfmtv.com
+ https://bugs.webkit.org/show_bug.cgi?id=52765
+
+ <rdar://problem/8890909> REGRESSION (r72141): Very Slow Rendering With Certain Markup
+ https://bugs.webkit.org/show_bug.cgi?id=52265
+
+ Test: fast/block/line-layout/negative-max-height.html
+
+ Integer overflow detection led to a block having a huge height. This manifested as broken layout
+ in the first bug and as extreme slowness in the latter bugs because of
+ https://bugs.webkit.org/show_bug.cgi?id=52832
+
+ * rendering/RootInlineBox.cpp:
+ (WebCore::RootInlineBox::alignBoxesInBlockDirection): Clamp maxHeight to 0 so the next line
+ cannot start above this line. The negative maxHeight also caused the integer overflow detection
+ logic to give the block a huge height.
+
2011-01-20 Yi Shen <yi.4.shen at nokia.com>
Reviewed by Eric Carlson.
diff --git a/Source/WebCore/WebCore.xcodeproj/project.pbxproj b/Source/WebCore/WebCore.xcodeproj/project.pbxproj
index 3af5015..d81d712 100644
--- a/Source/WebCore/WebCore.xcodeproj/project.pbxproj
+++ b/Source/WebCore/WebCore.xcodeproj/project.pbxproj
@@ -9538,11 +9538,11 @@
A5AFB34E115151A700B045CB /* StepRange.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StepRange.h; sourceTree = "<group>"; };
A5C974CF11485FF10066F2AB /* KeyEventCocoa.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = KeyEventCocoa.h; path = cocoa/KeyEventCocoa.h; sourceTree = "<group>"; };
A5C974D011485FF10066F2AB /* KeyEventCocoa.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; name = KeyEventCocoa.mm; path = cocoa/KeyEventCocoa.mm; sourceTree = "<group>"; };
- A6148A6112E41D3A0044A784 /* DOMHTMLKeygenElementInternal.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DOMHTMLKeygenElementInternal.h; path = DOMHTMLKeygenElementInternal.h; sourceTree = "<group>"; };
- A6148A6512E41D940044A784 /* DOMHTMLKeygenElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DOMHTMLKeygenElement.h; path = DOMHTMLKeygenElement.h; sourceTree = "<group>"; };
- A6148A6612E41D940044A784 /* DOMHTMLKeygenElement.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; name = DOMHTMLKeygenElement.mm; path = DOMHTMLKeygenElement.mm; sourceTree = "<group>"; };
- A6148A7612E41E3B0044A784 /* JSHTMLKeygenElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = JSHTMLKeygenElement.cpp; path = JSHTMLKeygenElement.cpp; sourceTree = "<group>"; };
- A6148A7712E41E3B0044A784 /* JSHTMLKeygenElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = JSHTMLKeygenElement.h; path = JSHTMLKeygenElement.h; sourceTree = "<group>"; };
+ A6148A6112E41D3A0044A784 /* DOMHTMLKeygenElementInternal.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMHTMLKeygenElementInternal.h; sourceTree = "<group>"; };
+ A6148A6512E41D940044A784 /* DOMHTMLKeygenElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMHTMLKeygenElement.h; sourceTree = "<group>"; };
+ A6148A6612E41D940044A784 /* DOMHTMLKeygenElement.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMHTMLKeygenElement.mm; sourceTree = "<group>"; };
+ A6148A7612E41E3B0044A784 /* JSHTMLKeygenElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLKeygenElement.cpp; sourceTree = "<group>"; };
+ A6148A7712E41E3B0044A784 /* JSHTMLKeygenElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSHTMLKeygenElement.h; sourceTree = "<group>"; };
A6148A7F12E41ED10044A784 /* HTMLKeygenElement.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = HTMLKeygenElement.idl; sourceTree = "<group>"; };
A622A8F5122C44A600A785B3 /* BindingSecurity.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = BindingSecurity.h; path = generic/BindingSecurity.h; sourceTree = "<group>"; };
A622A8F6122C44A600A785B3 /* BindingSecurityBase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = BindingSecurityBase.cpp; path = generic/BindingSecurityBase.cpp; sourceTree = "<group>"; };
diff --git a/Source/WebCore/rendering/RootInlineBox.cpp b/Source/WebCore/rendering/RootInlineBox.cpp
index 65130e7..e9e2029 100644
--- a/Source/WebCore/rendering/RootInlineBox.cpp
+++ b/Source/WebCore/rendering/RootInlineBox.cpp
@@ -266,6 +266,8 @@ int RootInlineBox::alignBoxesInBlockDirection(int heightOfBlock, GlyphOverflowAn
heightOfBlock += annotationsAdjustment;
}
+ maxHeight = max(0, maxHeight);
+
// Detect integer overflow.
if (heightOfBlock > numeric_limits<int>::max() - maxHeight)
return numeric_limits<int>::max();
--
WebKit Debian packaging
More information about the Pkg-webkit-commits
mailing list