More predictable handling of large negative CJK counter values.

Everything is first clamped to [INT_MIN, INT_MAX]. Then, if the value is negative, it will be negated to become positive. This won't work if the value is exactly INT_MIN, though, since INT_MIN (MSB set to 1; all other bits set to 0) has no positive counterpart. So handle this manually. Adding a non-exportable web test for this, since the behavior for such numbers is only defined between -9999 and 9999 [1]. [1] https://www.w3.org/TR/css-counter-styles-3/#complex-cjk Bug: 893954 Change-Id: I9f3bfad6e73623c27f2e1e427a96c45ad81d6265 Reviewed-on: https://chromium-review.googlesource.com/c/1350949Reviewed-by: Xiaocheng Hu <xiaochengh@chromium.org> Reviewed-by: Rune Lillesveen <futhark@chromium.org> Commit-Queue: Morten Stenshorne <mstensho@chromium.org> Cr-Commit-Position: refs/heads/master@{#611066}

More predictable handling of large negative CJK counter values.
Everything is first clamped to [INT_MIN, INT_MAX]. Then, if the value is negative, it will be negated to become positive. This won't work if the value is exactly INT_MIN, though, since INT_MIN (MSB set to 1; all other bits set to 0) has no positive counterpart. So handle this manually. Adding a non-exportable web test for this, since the behavior for such numbers is only defined between -9999 and 9999 [1]. [1] https://www.w3.org/TR/css-counter-styles-3/#complex-cjk Bug: 893954 Change-Id: I9f3bfad6e73623c27f2e1e427a96c45ad81d6265 Reviewed-on: https://chromium-review.googlesource.com/c/1350949Reviewed-by: Xiaocheng Hu <xiaochengh@chromium.org> Reviewed-by: Rune Lillesveen <futhark@chromium.org> Commit-Queue: Morten Stenshorne <mstensho@chromium.org> Cr-Commit-Position: refs/heads/master@{#611066}
3b49cce0 · Morten Stenshorne · Commit Bot · 8acca942 · 3b49cce0 · 3b49cce0
Commit 3b49cce0 authored Nov 27, 2018 by Morten Stenshorne Committed by Commit Bot Nov 27, 2018
3 changed files
--- a/third_party/blink/renderer/core/layout/list_marker_text.cc
+++ b/third_party/blink/renderer/core/layout/list_marker_text.cc
@@ -333,8 +333,14 @@ static String ToCJKIdeographic(int number,
    return String(&table[kDigit0], 1);

  const bool negative = number < 0;
-  if (negative)
-    number = -number;
+  if (negative) {
+    // Negating the most negative integer (INT_MIN) doesn't work, since it has
+    // no positive counterpart. Deal with that here, manually.
+    if (UNLIKELY(number == INT_MIN))
+      number = INT_MAX;
+    else
+      number = -number;
+  }

  const int kGroupLength =
      9;  // 4 digits, 3 digit markers, group marker of size 2.

--- a/third_party/blink/web_tests/fast/css/content-counter-large-negative-cjk-expected.html
+++ b/third_party/blink/web_tests/fast/css/content-counter-large-negative-cjk-expected.html
+<!DOCTYPE html>
+<meta http-equiv="content-type" content="text/html;charset=utf-8">
+<p>The string "负二十一亿四千七百四十八万三千六百四十七" (-2147483647 in
+  Chinese) should be seen below.</p>
+<div>负二十一亿四千七百四十八万三千六百四十七</div>
--- a/third_party/blink/web_tests/fast/css/content-counter-large-negative-cjk.html
+++ b/third_party/blink/web_tests/fast/css/content-counter-large-negative-cjk.html
+<!DOCTYPE html>
+<meta http-equiv="content-type" content="text/html;charset=utf-8">
+<style>
+  div::before { content: counter(n, simp-chinese-informal); }
+</style>
+<!-- This test assumes that we clamp absolute values to not be larger than 2^31. -->
+<p>The string "负二十一亿四千七百四十八万三千六百四十七" (-2147483647 in
+  Chinese) should be seen below.</p>
+<div style="counter-reset: n -10000000000;"></div>