Changeset 143669 in webkit

Timestamp:

Feb 21, 2013 5:11:02 PM (11 years ago)

Author:

eae@chromium.org

Message:

Lots of LayoutUnit assertions when loading a Wikipedia article
​https://bugs.webkit.org/show_bug.cgi?id=110270

Reviewed by Levi Weintraub.

Change RenderBlock::adjustRectForColumns to ensure that the
endColumn calculation does not overflow.

No new tests, covered by existing tests.

• rendering/RenderBlock.cpp:

(WebCore::RenderBlock::adjustRectForColumns):
Make the endOffset value be no less than the beforeBorderPadding
value to ensure that endColumn is not negative.

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• rendering/RenderBlock.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2013-02-21  Emil A Eklund  <eae@chromium.org>
+
+        Lots of LayoutUnit assertions when loading a Wikipedia article
+        https://bugs.webkit.org/show_bug.cgi?id=110270
+
+        Reviewed by Levi Weintraub.
+        
+        Change RenderBlock::adjustRectForColumns to ensure that the
+        endColumn calculation does not overflow.
+
+        No new tests, covered by existing tests.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::adjustRectForColumns):
+        Make the endOffset value be no less than the beforeBorderPadding
+        value to ensure that endColumn is not negative.
+
 2013-02-21  Eric Seidel  <eric@webkit.org>
 

trunk/Source/WebCore/rendering/RenderBlock.cpp

@@ -5616 +5616 @@
 
     LayoutUnit startOffset = max(isHorizontal ? r.y() : r.x(), beforeBorderPadding);
-    LayoutUnit endOffset = min<LayoutUnit>(isHorizontal ? r.maxY() : r.maxX(), beforeBorderPadding + colCount * colHeight);
+    LayoutUnit endOffset = max(min<LayoutUnit>(isHorizontal ? r.maxY() : r.maxX(), beforeBorderPadding + colCount * colHeight), beforeBorderPadding);
 
     // FIXME: Can overflow on fast/block/float/float-not-removed-from-next-sibling4.html, see https://bugs.webkit.org/show_bug.cgi?id=68744