Changeset 25171 in webkit


Ignore:
Timestamp:
Aug 21, 2007, 10:57:59 AM (18 years ago)
Author:
adele
Message:

WebCore:

Reviewed by Darin.

Test: fast/table/max-width-integer-overflow.html

Avoid integer overflows when dealing with maximum widths by
1) using floating point arithmetic when summing or multiplying column max widths
2) capping max widths at INT_MAX / 2

  • rendering/AutoTableLayout.cpp: (WebCore::AutoTableLayout::calcPrefWidths): (WebCore::AutoTableLayout::calcEffectiveWidth): (WebCore::AutoTableLayout::layout):

LayoutTests:

Reviewed by Darin.

  • fast/table/max-width-integer-overflow.html: Added.
  • platform/mac/fast/table: Added.
  • platform/mac/fast/table/max-width-integer-overflow-expected.checksum: Added.
  • platform/mac/fast/table/max-width-integer-overflow-expected.png: Added.
  • platform/mac/fast/table/max-width-integer-overflow-expected.txt: Added.
Location:
trunk
Files:
5 added
3 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r25168 r25171  
     12007-08-21  Mitz Pettel  <mitz@webkit.org>
     2
     3        Reviewed by Darin.
     4
     5        - test for http://bugs.webkit.org/show_bug.cgi?id=15010
     6          <rdar://problem/5423956> REGRESSION (r25000-r25065): Table rendering broken by a recent nightly
     7
     8        * fast/table/max-width-integer-overflow.html: Added.
     9        * platform/mac/fast/table: Added.
     10        * platform/mac/fast/table/max-width-integer-overflow-expected.checksum: Added.
     11        * platform/mac/fast/table/max-width-integer-overflow-expected.png: Added.
     12        * platform/mac/fast/table/max-width-integer-overflow-expected.txt: Added.
     13
    1142007-08-20  Mitz Pettel  <mitz@webkit.org>
    215

  • trunk/WebCore/ChangeLog

    r25170 r25171  
     12007-08-21  Mitz Pettel  <mitz@webkit.org>
     2
     3        Reviewed by Darin.
     4
     5        - fix http://bugs.webkit.org/show_bug.cgi?id=15010
     6          <rdar://problem/5423956> REGRESSION (r25000-r25065): Table rendering broken by a recent nightly
     7
     8        Test: fast/table/max-width-integer-overflow.html
     9
     10        Avoid integer overflows when dealing with maximum widths by
     11        1) using floating point arithmetic when summing or multiplying column max widths
     12        2) capping max widths at INT_MAX / 2
     13
     14        * rendering/AutoTableLayout.cpp:
     15        (WebCore::AutoTableLayout::calcPrefWidths):
     16        (WebCore::AutoTableLayout::calcEffectiveWidth):
     17        (WebCore::AutoTableLayout::layout):
     18
    1192007-08-20  John Sullivan  <sullivan@apple.com>
    220

  • trunk/WebCore/rendering/AutoTableLayout.cpp

    r25011 r25171  
    255255    minWidth = 0;
    256256    maxWidth = 0;
    257     int maxPercent = 0;
    258     int maxNonPercent = 0;
     257    float maxPercent = 0;
     258    float maxNonPercent = 0;
     259    bool scaleColumns = shouldScaleColumns(m_table);
    259260
    260261    // We substitute 0 percent by (epsilon / percentScaleFactor) percent in two places below to avoid division by zero.
    … …  
    266267        minWidth += m_layoutStruct[i].effMinWidth;
    267268        maxWidth += m_layoutStruct[i].effMaxWidth;
    268         if (m_layoutStruct[i].effWidth.isPercent()) {
    269             int percent = min(m_layoutStruct[i].effWidth.rawValue(), remainingPercent);
    270             int pw = (m_layoutStruct[i].effMaxWidth * 100 * percentScaleFactor) / max(percent, epsilon);
    271             remainingPercent -= percent;
    272             maxPercent = max(pw,  maxPercent);
    273         } else {
    274             maxNonPercent += m_layoutStruct[i].effMaxWidth;
    275         }
    276     }
    277 
    278     if (shouldScaleColumns(m_table)) {
     269        if (scaleColumns) {
     270            if (m_layoutStruct[i].effWidth.isPercent()) {
     271                int percent = min(m_layoutStruct[i].effWidth.rawValue(), remainingPercent);
     272                float pw = static_cast<float>(m_layoutStruct[i].effMaxWidth) * 100 * percentScaleFactor / max(percent, epsilon);
     273                maxPercent = max(pw,  maxPercent);
     274                remainingPercent -= percent;
     275            } else
     276                maxNonPercent += m_layoutStruct[i].effMaxWidth;
     277        }
     278    }
     279
     280    if (scaleColumns) {
    279281        maxNonPercent = maxNonPercent * 100 * percentScaleFactor / max(remainingPercent, epsilon);
    280         maxWidth = max(maxNonPercent,  maxWidth);
    281         maxWidth = max(maxWidth, maxPercent);
     282        maxWidth = max(maxWidth, static_cast<int>(min(maxNonPercent, INT_MAX / 2.0f)));
     283        maxWidth = max(maxWidth, static_cast<int>(min(maxPercent, INT_MAX / 2.0f)));
    282284    }
    283285
    … …  
    301303int AutoTableLayout::calcEffectiveWidth()
    302304{
    303     int tMaxWidth = 0;
     305    float tMaxWidth = 0;
    304306
    305307    unsigned int nEffCols = m_layoutStruct.size();
    … …  
    327329        unsigned int lastCol = col;
    328330        int cMinWidth = cell->minPrefWidth() + hspacing;
    329         int cMaxWidth = cell->maxPrefWidth() + hspacing;
     331        float cMaxWidth = cell->maxPrefWidth() + hspacing;
    330332        int totalPercent = 0;
    331333        int minWidth = 0;
    332         int maxWidth = 0;
     334        float maxWidth = 0;
    333335        bool allColsArePercent = true;
    334336        bool allColsAreFixed = true;
    … …  
    386388                w = Length();
    387389            } else {
    388                 int spanMax = max(maxWidth, cMaxWidth);
     390                float spanMax = max(maxWidth, cMaxWidth);
    389391                tMaxWidth = max(tMaxWidth, spanMax * 100 * percentScaleFactor / w.rawValue());
    390392
    391393                // all non percent columns in the span get percent vlaues to sum up correctly.
    392394                int percentMissing = w.rawValue() - totalPercent;
    393                 int totalWidth = 0;
     395                float totalWidth = 0;
    394396                for (unsigned int pos = col; pos < lastCol; pos++) {
    395397                    if (!(m_layoutStruct[pos].effWidth.isPercent()))
    … …  
    399401                for (unsigned int pos = col; pos < lastCol && totalWidth > 0; pos++) {
    400402                    if (!(m_layoutStruct[pos].effWidth.isPercent())) {
    401                         int percent = percentMissing * m_layoutStruct[pos].effMaxWidth / totalWidth;
     403                        int percent = percentMissing * static_cast<float>(m_layoutStruct[pos].effMaxWidth) / totalWidth;
    402404                        totalWidth -= m_layoutStruct[pos].effMaxWidth;
    403405                        percentMissing -= percent;
    … …  
    423425
    424426            } else {
    425                 int maxw = maxWidth;
     427                float maxw = maxWidth;
    426428                int minw = minWidth;
    427429               
    … …  
    440442                for (unsigned int pos = col; maxw >= 0 && pos < lastCol && minw < cMinWidth; pos++) {
    441443                    if (!(m_layoutStruct[pos].width.isFixed() && haveAuto && fixedWidth <= cMinWidth)) {
    442                         int w = max(m_layoutStruct[pos].effMinWidth, maxw ? (cMinWidth * m_layoutStruct[pos].effMaxWidth / maxw) : cMinWidth);
     444                        int w = max(m_layoutStruct[pos].effMinWidth, static_cast<int>(maxw ? cMinWidth * static_cast<float>(m_layoutStruct[pos].effMaxWidth) / maxw : cMinWidth));
    443445                        w = min(m_layoutStruct[pos].effMinWidth+(cMinWidth-minw), w);
    444446                                               
    … …  
    454456            if (cMaxWidth > maxWidth) {
    455457                for (unsigned int pos = col; maxWidth >= 0 && pos < lastCol; pos++) {
    456                     int w = max(m_layoutStruct[pos].effMaxWidth, maxWidth ? (cMaxWidth * m_layoutStruct[pos].effMaxWidth / maxWidth) : cMaxWidth);
     458                    int w = max(m_layoutStruct[pos].effMaxWidth, static_cast<int>(maxWidth ? cMaxWidth * static_cast<float>(m_layoutStruct[pos].effMaxWidth) / maxWidth : cMaxWidth));
    457459                    maxWidth -= m_layoutStruct[pos].effMaxWidth;
    458460                    cMaxWidth -= w;
    … …  
    471473    m_effWidthDirty = false;
    472474
    473     return tMaxWidth;
     475    return static_cast<int>(min(tMaxWidth, INT_MAX / 2.0f));
    474476}
    475477
    … …  
    535537    int numAuto = 0;
    536538    int numFixed = 0;
    537     int totalAuto = 0;
    538     int totalFixed = 0;
     539    float totalAuto = 0;
     540    float totalFixed = 0;
    539541    int totalPercent = 0;
    540542    int allocAuto = 0;
    … …  
    639641            Length &width = m_layoutStruct[i].effWidth;
    640642            if (width.isAuto() && totalAuto != 0 && !m_layoutStruct[i].emptyCellsOnly) {
    641                 int w = max(int(m_layoutStruct[i].calcWidth), available * m_layoutStruct[i].effMaxWidth / totalAuto);
     643                int w = max(m_layoutStruct[i].calcWidth, static_cast<int>(available * static_cast<float>(m_layoutStruct[i].effMaxWidth) / totalAuto));
    642644                available -= w;
    643645                totalAuto -= m_layoutStruct[i].effMaxWidth;
    … …  
    656658            Length &width = m_layoutStruct[i].effWidth;
    657659            if (width.isFixed()) {
    658                 int w = available * m_layoutStruct[i].effMaxWidth / totalFixed;
     660                int w = available * static_cast<float>(m_layoutStruct[i].effMaxWidth) / totalFixed;
    659661                available -= w;
    660662                totalFixed -= m_layoutStruct[i].effMaxWidth;
Note: See TracChangeset for help on using the changeset viewer.