Skip to content

GitLab

T
tangled
Commit fec20f20 authored by a.suchit@samsung.com's avatar a.suchit@samsung.com
Browse files
Options

ASSERTION FAILED: !remainder in WebCore::RenderTableSection::distributeExtraRowSpanHeightToAutoRows 

While distributing the extra rowspan height in rows, result of multiplication
is overflowing in integer and whole method is getting failed due to this. So
typecasted a value to 'long long' and final result of the calculation always
fits in integer range.

BUG=334652
R=jchaffraix@chromium.org

Review URL: https://codereview.chromium.org/131103017

git-svn-id: svn://svn.chromium.org/blink/trunk@169843 bbb929c8-8fbe-4397-9dbb-9b2b20218538
parent ece569da
Hide whitespace changes
Inline Side-by-side
Showing with 46 additions and 4 deletions
third_party/WebKit/LayoutTests/fast/table/table-rowspan-crash-with-huge-pedding-value-expected.txt 0 → 100644
View file @ fec20f20
Test for chromium bug : 334652. ASSERTION FAILED: !remainder in WebCore::RenderTableSection::distributeExtraRowSpanHeightToAutoRows.
For this test to PASS, it should not crash.
r0c0
r0c1
rowspan=2
third_party/WebKit/LayoutTests/fast/table/table-rowspan-crash-with-huge-pedding-value.html 0 → 100644
View file @ fec20f20
<!DOCTYPE html>
<html>
<head>
<script type="text/javascript">
if (window.testRunner)
testRunner.dumpAsText();
</script>
<style>
td, h4, h6 {padding-top:25000pt;}
</style>
</head>
<body>
<h2>Test for chromium bug : <a href="https://code.google.com/p/chromium/issues/detail?id=334652">334652</a>. ASSERTION FAILED: !remainder in WebCore::RenderTableSection::distributeExtraRowSpanHeightToAutoRows.</h3>
<h3>For this test to PASS, it should not crash.</h4>
<table border="1">
<tr>
<td>r0c0</td>
<td rowspan="2">
<h6>r0c1</h6>
<h4> rowspan=2</h4>
</td>
</tr>
</table>
</body>
</html>
third_party/WebKit/Source/core/rendering/RenderTableSection.cpp
View file @ fec20f20
...@@ -328,6 +328,17 @@ void RenderTableSection::distributeExtraRowSpanHeightToPercentRows(RenderTableCe ...@@ -328,6 +328,17 @@ void RenderTableSection::distributeExtraRowSpanHeightToPercentRows(RenderTableCe
} }
} }
// Sometimes the multiplication of the 2 values below will overflow an integer.
// So we convert the parameters to 'long long' instead of 'int' to avoid the
// problem in this function.
static void updatePositionIncreasedWithRowHeight(long long extraHeight, long long rowHeight, long long totalHeight, int& accumulatedPositionIncrease, int& remainder)
{
COMPILE_ASSERT(sizeof(long long int) > sizeof(int), int_should_be_less_than_longlong);
accumulatedPositionIncrease += (extraHeight * rowHeight) / totalHeight;
remainder += (extraHeight * rowHeight) % totalHeight;
}
void RenderTableSection::distributeExtraRowSpanHeightToAutoRows(RenderTableCell* cell, int totalAutoRowsHeight, int& extraRowSpanningHeight, Vector<int>& rowsHeight) void RenderTableSection::distributeExtraRowSpanHeightToAutoRows(RenderTableCell* cell, int totalAutoRowsHeight, int& extraRowSpanningHeight, Vector<int>& rowsHeight)
{ {
if (!extraRowSpanningHeight || !totalAutoRowsHeight) if (!extraRowSpanningHeight || !totalAutoRowsHeight)
...@@ -342,8 +353,7 @@ void RenderTableSection::distributeExtraRowSpanHeightToAutoRows(RenderTableCell* ...@@ -342,8 +353,7 @@ void RenderTableSection::distributeExtraRowSpanHeightToAutoRows(RenderTableCell*
// So extra height distributed in auto spanning rows based on their weight in spanning cell. // So extra height distributed in auto spanning rows based on their weight in spanning cell.
for (unsigned row = rowIndex; row < (rowIndex + rowSpan); row++) { for (unsigned row = rowIndex; row < (rowIndex + rowSpan); row++) {
if (m_grid[row].logicalHeight.isAuto()) { if (m_grid[row].logicalHeight.isAuto()) {
accumulatedPositionIncrease += (extraRowSpanningHeight * rowsHeight[row - rowIndex]) / totalAutoRowsHeight; updatePositionIncreasedWithRowHeight(extraRowSpanningHeight, rowsHeight[row - rowIndex], totalAutoRowsHeight, accumulatedPositionIncrease, remainder);
remainder += (extraRowSpanningHeight * rowsHeight[row - rowIndex]) % totalAutoRowsHeight;
// While whole extra spanning height is distributing in auto spanning rows, rational parts remains // While whole extra spanning height is distributing in auto spanning rows, rational parts remains
// in every integer division. So accumulating all remainder part in integer division and when total remainder // in every integer division. So accumulating all remainder part in integer division and when total remainder
...@@ -376,8 +386,7 @@ void RenderTableSection::distributeExtraRowSpanHeightToRemainingRows(RenderTable ...@@ -376,8 +386,7 @@ void RenderTableSection::distributeExtraRowSpanHeightToRemainingRows(RenderTable
// So extra height distribution in remaining spanning rows based on their weight in spanning cell. // So extra height distribution in remaining spanning rows based on their weight in spanning cell.
for (unsigned row = rowIndex; row < (rowIndex + rowSpan); row++) { for (unsigned row = rowIndex; row < (rowIndex + rowSpan); row++) {
if (!m_grid[row].logicalHeight.isPercent()) { if (!m_grid[row].logicalHeight.isPercent()) {
accumulatedPositionIncrease += (extraRowSpanningHeight * rowsHeight[row - rowIndex]) / totalRemainingRowsHeight; updatePositionIncreasedWithRowHeight(extraRowSpanningHeight, rowsHeight[row - rowIndex], totalRemainingRowsHeight, accumulatedPositionIncrease, remainder);
remainder += (extraRowSpanningHeight * rowsHeight[row - rowIndex]) % totalRemainingRowsHeight;
// While whole extra spanning height is distributing in remaining spanning rows, rational parts remains // While whole extra spanning height is distributing in remaining spanning rows, rational parts remains
// in every integer division. So accumulating all remainder part in integer division and when total remainder // in every integer division. So accumulating all remainder part in integer division and when total remainder
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment