Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 5bd4dca3519bced58a50b6adb2d9d1cd8fa311d1
https://github.com/WebKit/WebKit/commit/5bd4dca3519bced58a50b6adb2d9d1cd8fa311d1
Author: Ahmad Saleem <[email protected]>
Date: 2026-07-21 (Tue, 21 Jul 2026)
Changed paths:
M
Source/WebCore/layout/integration/inline/LayoutIntegrationInlineContentBuilder.cpp
Log Message:
-----------
Fix unsigned underflow when adjusting cached box indexes after partial inline
layout damage repair
https://bugs.webkit.org/show_bug.cgi?id=319718
rdar://182553956
Reviewed by Alan Baradlay.
In InlineContentBuilder::handlePartialDisplayContentUpdate(), the box-index
adjustment for clean lines following a partial damage repair computed an
unsigned offset and clamped it with std::max<size_t>(0, ...). Since size_t
is unsigned, comparison against 0 is always true, so the clamp was a
no-op: when numberOfDamagedBoxes exceeded numberOfNewBoxes, the subtraction
underflowed and the adjusted firstBoxIndex of a clean line silently wrapped
to a huge garbage value instead of being clamped to 0.
Replace the single unsigned subtraction with per-line logic, scoped to the
loop, that branches on whether the box count grew or shrank, only
subtracting when it cannot underflow and clamping to 0 explicitly otherwise.
*
Source/WebCore/layout/integration/inline/LayoutIntegrationInlineContentBuilder.cpp:
(WebCore::LayoutIntegration::InlineContentBuilder::handlePartialDisplayContentUpdate
const):
Canonical link: https://commits.webkit.org/317613@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
