Title: [143045] trunk
- Revision
- 143045
- Author
- e...@chromium.org
- Date
- 2013-02-15 13:35:57 -0800 (Fri, 15 Feb 2013)
Log Message
Clamp span value in RenderTableCell::parse[Col|Row]SpanFromDOM
https://bugs.webkit.org/show_bug.cgi?id=109878
Source/WebCore:
Reviewed by Abhishek Arya.
Test: fast/table/colspan-huge-number.html
Clamp colspan and rowspan values to their respective maximum
supported values.
* rendering/RenderTableCell.cpp:
(WebCore::RenderTableCell::parseColSpanFromDOM):
(WebCore::RenderTableCell::parseRowSpanFromDOM):
LayoutTests:
Reviewed by Abhishek Arya.
Add test for handling of very large colspan value.
* fast/table/colspan-huge-number-expected.txt: Added.
* fast/table/colspan-huge-number.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (143044 => 143045)
--- trunk/LayoutTests/ChangeLog 2013-02-15 21:30:17 UTC (rev 143044)
+++ trunk/LayoutTests/ChangeLog 2013-02-15 21:35:57 UTC (rev 143045)
@@ -1,3 +1,15 @@
+2013-02-14 Emil A Eklund <e...@chromium.org>
+
+ Clamp span value in RenderTableCell::parse[Col|Row]SpanFromDOM
+ https://bugs.webkit.org/show_bug.cgi?id=109878
+
+ Reviewed by Abhishek Arya.
+
+ Add test for handling of very large colspan value.
+
+ * fast/table/colspan-huge-number-expected.txt: Added.
+ * fast/table/colspan-huge-number.html: Added.
+
2013-02-15 Xueqing Huang <huangxueq...@baidu.com>
Flexbox should ignore firstLine pseudo element.
Added: trunk/LayoutTests/fast/table/colspan-huge-number-expected.txt (0 => 143045)
--- trunk/LayoutTests/fast/table/colspan-huge-number-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/table/colspan-huge-number-expected.txt 2013-02-15 21:35:57 UTC (rev 143045)
@@ -0,0 +1 @@
+PASS: WebKit didn't crash
Property changes on: trunk/LayoutTests/fast/table/colspan-huge-number-expected.txt
___________________________________________________________________
Added: svn:eol-style
Added: trunk/LayoutTests/fast/table/colspan-huge-number.html (0 => 143045)
--- trunk/LayoutTests/fast/table/colspan-huge-number.html (rev 0)
+++ trunk/LayoutTests/fast/table/colspan-huge-number.html 2013-02-15 21:35:57 UTC (rev 143045)
@@ -0,0 +1,15 @@
+<!DOCTYLE html>
+<html>
+ <body>
+ <script>
+ if (window.testRunner)
+ testRunner.dumpAsText();
+ </script>
+ <table>
+ <tr>
+ <td colspan="2147483647">PASS: WebKit didn't crash</TD>
+ <td></td>
+ </tr>
+ </table>
+ </body>
+</html>
Property changes on: trunk/LayoutTests/fast/table/colspan-huge-number.html
___________________________________________________________________
Added: svn:mime-type
Added: svn:eol-style
Modified: trunk/Source/WebCore/ChangeLog (143044 => 143045)
--- trunk/Source/WebCore/ChangeLog 2013-02-15 21:30:17 UTC (rev 143044)
+++ trunk/Source/WebCore/ChangeLog 2013-02-15 21:35:57 UTC (rev 143045)
@@ -1,3 +1,19 @@
+2013-02-14 Emil A Eklund <e...@chromium.org>
+
+ Clamp span value in RenderTableCell::parse[Col|Row]SpanFromDOM
+ https://bugs.webkit.org/show_bug.cgi?id=109878
+
+ Reviewed by Abhishek Arya.
+
+ Test: fast/table/colspan-huge-number.html
+
+ Clamp colspan and rowspan values to their respective maximum
+ supported values.
+
+ * rendering/RenderTableCell.cpp:
+ (WebCore::RenderTableCell::parseColSpanFromDOM):
+ (WebCore::RenderTableCell::parseRowSpanFromDOM):
+
2013-02-15 Andreas Kling <akl...@apple.com>
ShareableElementData should use zero-length array for storage.
Modified: trunk/Source/WebCore/rendering/RenderTableCell.cpp (143044 => 143045)
--- trunk/Source/WebCore/rendering/RenderTableCell.cpp 2013-02-15 21:30:17 UTC (rev 143044)
+++ trunk/Source/WebCore/rendering/RenderTableCell.cpp 2013-02-15 21:35:57 UTC (rev 143045)
@@ -79,10 +79,10 @@
{
ASSERT(node());
if (node()->hasTagName(tdTag) || node()->hasTagName(thTag))
- return toHTMLTableCellElement(node())->colSpan();
+ return min<unsigned>(toHTMLTableCellElement(node())->colSpan(), maxColumnIndex);
#if ENABLE(MATHML)
if (node()->hasTagName(MathMLNames::mtdTag))
- return toMathMLElement(node())->colSpan();
+ return min<unsigned>(toMathMLElement(node())->colSpan(), maxColumnIndex);
#endif
return 1;
}
@@ -91,10 +91,10 @@
{
ASSERT(node());
if (node()->hasTagName(tdTag) || node()->hasTagName(thTag))
- return toHTMLTableCellElement(node())->rowSpan();
+ return min<unsigned>(toHTMLTableCellElement(node())->rowSpan(), maxRowIndex);
#if ENABLE(MATHML)
if (node()->hasTagName(MathMLNames::mtdTag))
- return toMathMLElement(node())->rowSpan();
+ return min<unsigned>(toMathMLElement(node())->rowSpan(), maxRowIndex);
#endif
return 1;
}
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
