Changeset 202489 in webkit


Ignore:
Timestamp:
Jun 27, 2016 10:36:09 AM (8 years ago)
Author:
fred.wang@free.fr
Message:

Set an upper limit for the size or number of pieces of stretchy operators
​https://bugs.webkit.org/show_bug.cgi?id=155434

Source/WebCore:

Patch by Frederic Wang <​fwang@igalia.com> on 2016-06-27
Reviewed by Brent Fulgham.

Stretchy MathML operators can currently use an arbitrary number of extension glyphs to cover
a target size. This may result in hangs if large stretch sizes are requested. This change
only allow at most the 128 first extensions to be painted by the MathOperator class, which
should really be enough for mathematical formulas used in practice.

No new tests, already tested by very-large-stretchy-operators.

  • rendering/mathml/MathOperator.cpp: Add a new kMaximumExtensionCount constant.

(WebCore::MathOperator::fillWithVerticalExtensionGlyph): Limit the number of step in this loop to kMaximumExtensionCount.
(WebCore::MathOperator::fillWithHorizontalExtensionGlyph): Ditto.

LayoutTests:

Update test expectations for very-large-stretchy-operators.

Patch by Frederic Wang <​fwang@igalia.com> on 2016-06-27
Reviewed by Brent Fulgham.

  • platform/efl/TestExpectations:
  • platform/gtk/TestExpectations:
  • platform/ios-simulator/TestExpectations:
  • platform/mac/TestExpectations:
  • platform/win/TestExpectations:
Location:
trunk
Files:
8 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r202486 r202489  
     12016-06-27  Frederic Wang  <fwang@igalia.com>
     2
     3        Set an upper limit for the size or number of pieces of stretchy operators
     4        https://bugs.webkit.org/show_bug.cgi?id=155434
     5
     6        Update test expectations for very-large-stretchy-operators.
     7
     8        Reviewed by Brent Fulgham.
     9
     10        * platform/efl/TestExpectations:
     11        * platform/gtk/TestExpectations:
     12        * platform/ios-simulator/TestExpectations:
     13        * platform/mac/TestExpectations:
     14        * platform/win/TestExpectations:
     15
    1162016-06-27  Ryan Haddad  <ryanhaddad@apple.com>
    217

  • trunk/LayoutTests/platform/efl/TestExpectations

    r202447 r202489  
    762762webkit.org/b/136099 fast/events/scroll-event-during-modal-dialog.html [ Crash Timeout ]
    763763webkit.org/b/136099 fast/harness/show-modal-dialog.html [ Crash Timeout ]
    764 
    765 webkit.org/b/136227 mathml/very-large-stretchy-operators.html [ Crash Timeout Pass ]
    766764
    767765#webkit.org/b/142158 inspector/dom/remove-multiple-nodes.html [ Crash Pass ]

  • trunk/LayoutTests/platform/gtk/TestExpectations

    r202485 r202489  
    16081608
    16091609# May take too long on the bots.
    1610 Bug(GTK) mathml/very-large-stretchy-operators.html [ Pass Timeout ]
    16111610
    16121611Bug(GTK) fast/history/go-back-to-iframe-with-plugin.html [ Timeout Pass ]

  • trunk/LayoutTests/platform/ios-simulator/TestExpectations

    r202486 r202489  
    29512951webkit.org/b/155339 [ Debug ] imported/blink/fast/multicol/dynamic/relayout-abspos-in-relpos-spanner.html [ Pass Crash ]
    29522952
    2953 webkit.org/b/155565 [ Debug ] mathml/very-large-stretchy-operators.html [ Skip ]
    2954 
    29552953# RTL Scrollbars are not implemented on iOS.
    29562954fast/scrolling/rtl-scrollbars-sticky-document-2.html [ ImageOnlyFailure ]

  • trunk/LayoutTests/platform/mac/TestExpectations

    r202466 r202489  
    729729
    730730webkit.org/b/122038 animations/transform-non-accelerated.html [ Pass Failure ]
    731 
    732 webkit.org/b/122490 [ Debug ] mathml/very-large-stretchy-operators.html [ Skip ]
    733 
    734 # rdar://problem/21443002
    735 [ Release ElCapitan+ ] mathml/very-large-stretchy-operators.html [ Slow ]
    736731
    737732webkit.org/b/123220 compositing/regions/floated-region-with-transformed-child.html [ Pass ImageOnlyFailure ]

  • trunk/LayoutTests/platform/win/TestExpectations

    r202447 r202489  
    19651965mathml/presentation/style-changed.html [ Crash Pass ]
    19661966webkit.org/b/140522 mathml/opentype/munderover-layout-resize.html [ Skip ]  # Crashing
    1967 mathml/very-large-stretchy-operators.html [ Skip ]
    19681967################################################################################
    19691968#################          End MathML Issues                ####################

  • trunk/Source/WebCore/ChangeLog

    r202488 r202489  
     12016-06-27  Frederic Wang  <fwang@igalia.com>
     2
     3        Set an upper limit for the size or number of pieces of stretchy operators
     4        https://bugs.webkit.org/show_bug.cgi?id=155434
     5
     6        Reviewed by Brent Fulgham.
     7
     8        Stretchy MathML operators can currently use an arbitrary number of extension glyphs to cover
     9        a target size. This may result in hangs if large stretch sizes are requested. This change
     10        only allow at most the 128 first extensions to be painted by the MathOperator class, which
     11        should really be enough for mathematical formulas used in practice.
     12
     13        No new tests, already tested by very-large-stretchy-operators.
     14
     15        * rendering/mathml/MathOperator.cpp: Add a new kMaximumExtensionCount constant.
     16        (WebCore::MathOperator::fillWithVerticalExtensionGlyph): Limit the number of step in this loop to kMaximumExtensionCount.
     17        (WebCore::MathOperator::fillWithHorizontalExtensionGlyph): Ditto.
     18
    1192016-06-27  Frederic Wang  <fred.wang@free.fr>
    220

  • trunk/Source/WebCore/rendering/mathml/MathOperator.cpp

    r202161 r202489  
    3333
    3434static const unsigned kRadicalOperator = 0x221A;
     35static const unsigned kMaximumExtensionCount = 128;
    3536
    3637namespace WebCore {
    … …  
    491492    FloatRect lastPaintedGlyphRect(from, FloatSize());
    492493
    493     // FIXME: In practice, only small stretch sizes are requested but we may need to limit the number
    494     // of pieces that can be repeated to avoid hangs. See http://webkit.org/b/155434
    495     while (lastPaintedGlyphRect.maxY() < to.y()) {
     494    // In practice, only small stretch sizes are requested but we limit the number of glyphs to avoid hangs.
     495    for (unsigned extensionCount = 0; lastPaintedGlyphRect.maxY() < to.y() && extensionCount < kMaximumExtensionCount; extensionCount++) {
    496496        lastPaintedGlyphRect = paintGlyph(style, info, m_assembly.extension, glyphOrigin, TrimTopAndBottom);
    497497        glyphOrigin.setY(glyphOrigin.y() + lastPaintedGlyphRect.height());
    … …  
    530530    FloatRect lastPaintedGlyphRect(from, FloatSize());
    531531
    532     // FIXME: In practice, only small stretch sizes are requested but we may need to limit the number
    533     // of pieces that can be repeated to avoid hangs. See http://webkit.org/b/155434
    534     while (lastPaintedGlyphRect.maxX() < to.x()) {
     532    // In practice, only small stretch sizes are requested but we limit the number of glyphs to avoid hangs.
     533    for (unsigned extensionCount = 0; lastPaintedGlyphRect.maxX() < to.x() && extensionCount < kMaximumExtensionCount; extensionCount++) {
    535534        lastPaintedGlyphRect = paintGlyph(style, info, m_assembly.extension, glyphOrigin, TrimLeftAndRight);
    536535        glyphOrigin.setX(glyphOrigin.x() + lastPaintedGlyphRect.width());
Note: See TracChangeset for help on using the changeset viewer.