| commit | fd971a0591f9ccd461aba10da1d1858d96bc6279 | |
| author | rob.buis@samsung.com <rob.buis@samsung.com> | |
| Fri, 10 Apr 2015 23:11:19 +0000 (10 23:11 +0000) | ||
| committer | rob.buis@samsung.com <rob.buis@samsung.com> | |
| Fri, 10 Apr 2015 23:11:19 +0000 (10 23:11 +0000) | ||
| tree | 8d457f8267956a6679466dbb050f45820a72efea | treesnapshot (tar.gz zip) |
| parent | 36e5f4525762484c5ab5bcbc175ee7b0c6c3657f | commitdiff |
Fix integer overflow in ComputedStyle::computedLineHeight
When we compute huge values for line-height through
percentage or CSS calc, we'll overflow the integer and later
on ShapeOutsideInfo::computeDeltasForContainingBlockLine
will ASSERT because it expects non-negative line height.
So for the computed line height use an intermediate LayoutUnit
because it internally clamps to intMaxForLayoutUnit and the int
will not overflow. Note that the code path in computedLineHeight
for percentages does the same.
BUG=458461
Review URL: https://codereview.chromium.org/1016863002
git-svn-id: svn://svn.chromium.org/blink/trunk@193574 bbb929c8-8fbe-4397-9dbb-9b2b20218538
When we compute huge values for line-height through
percentage or CSS calc, we'll overflow the integer and later
on ShapeOutsideInfo::computeDeltasForContainingBlockLine
will ASSERT because it expects non-negative line height.
So for the computed line height use an intermediate LayoutUnit
because it internally clamps to intMaxForLayoutUnit and the int
will not overflow. Note that the code path in computedLineHeight
for percentages does the same.
BUG=458461
Review URL: https://codereview.chromium.org/1016863002
git-svn-id: svn://svn.chromium.org/blink/trunk@193574 bbb929c8-8fbe-4397-9dbb-9b2b20218538