Changeset 51517 in webkit

Timestamp:

Nov 30, 2009 3:55:38 PM (14 years ago)

Author:

Beth Dakin

Message:

WebCore: Fix for ​https://bugs.webkit.org/show_bug.cgi?id=32000 Crash in
Safari caused by extreme column-gap and column-width values
-and corresponding-
<rdar://problem/7425433>

Reviewed by Oliver Hunt.

Prevent desiredColumnCount from being less than 1 since it is used
as a divisor.

• rendering/RenderBlock.cpp:

(WebCore::RenderBlock::calcColumnWidth):

LayoutTests: Test for ​https://bugs.webkit.org/show_bug.cgi?id=32000 Crash in
Safari caused by extreme column-gap and column-width values
-and corresponding-
<rdar://problem/7425433>

Reviewed by Oliver Hunt.

• fast/multicol/huge-column-gap-crash-expected.txt: Added.
• fast/multicol/huge-column-gap-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/multicol/huge-column-gap-crash-expected.txt (added)
• LayoutTests/fast/multicol/huge-column-gap-crash.html (added)
• WebCore/ChangeLog (modified) (1 diff)
• WebCore/rendering/RenderBlock.cpp (modified) (3 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2009-11-30  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Test for https://bugs.webkit.org/show_bug.cgi?id=32000 Crash in 
+        Safari caused by extreme column-gap and column-width values 
+        -and corresponding-
+        <rdar://problem/7425433>
+
+        * fast/multicol/huge-column-gap-crash-expected.txt: Added.
+        * fast/multicol/huge-column-gap-crash.html: Added.
+
 2009-11-30  Alexey Proskuryakov  <ap@apple.com>
 

trunk/WebCore/ChangeLog

@@ +1 @@
+2009-11-30  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=32000 Crash in 
+        Safari caused by extreme column-gap and column-width values 
+        -and corresponding-
+        <rdar://problem/7425433>
+
+        Prevent desiredColumnCount from being less than 1 since it is used 
+        as a divisor.
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::calcColumnWidth):
+
 2009-11-30  Alexey Proskuryakov  <ap@apple.com>
 

trunk/WebCore/rendering/RenderBlock.cpp

@@ -3554 +3554 @@
         } else if (colGap < availWidth) {
             desiredColumnCount = availWidth / colGap;
+            if (desiredColumnCount < 1)
+                desiredColumnCount = 1;
             desiredColumnWidth = (availWidth - (desiredColumnCount - 1) * colGap) / desiredColumnCount;
         }
@@ -3559 +3561 @@
         if (colWidth < availWidth) {
             desiredColumnCount = (availWidth + colGap) / (colWidth + colGap);
+            if (desiredColumnCount < 1)
+                desiredColumnCount = 1;
             desiredColumnWidth = (availWidth - (desiredColumnCount - 1) * colGap) / desiredColumnCount;
         }
@@ -3568 +3572 @@
         } else if (colWidth < availWidth) {
             desiredColumnCount = (availWidth + colGap) / (colWidth + colGap);
+            if (desiredColumnCount < 1)
+                desiredColumnCount = 1;
             desiredColumnWidth = (availWidth - (desiredColumnCount - 1) * colGap) / desiredColumnCount;
         }