Merge r175197 - Clamp wordSpacing percentage value.

https://bugs.webkit.org/show_bug.cgi?id=129350. Patch by Said Abou-Hallawa <sabouhallawa@apple.com> on 2014-10-24 Reviewed by Zalan Bujtas. Source/WebCore: When the CSS wordSpacing property is percentage, its value has to be within the pre-defined min/max values for the CSS length type. This is done the same way the wordSpacing of type <length> is handled. Tests: css3/infinite-word-spacing.html. Move the definitions of minValueForCssLength and maxValueForCssLength from the .cpp file to the .h file. * css/CSSPrimitiveValue.cpp: * css/CSSPrimitiveValue.h: Clamp the wordSpacing value to minValueForCssLength and maxValueForCssLength when its type is percentage. * css/DeprecatedStyleBuilder.cpp: (WebCore::ApplyPropertyWordSpacing::applyValue): LayoutTests: Make sure that setting the CSS style wordSpacing property to very huge percentage value and blending this value with other values for animating key frames does not assert or crash. The expectation is to have this huge value to be clamped to the pre-defined min/max values for the CSS length type. So when blending the clamped value with other wordSpacing values, the result can't be NaN. This should be very similar to the case when it is set to a huge <length> value. * css3/infinite-word-spacing-expected.txt: Added. * css3/infinite-word-spacing.html: Added. Canonical link: https://commits.webkit.org/154760.172@webkitgtk/2.6 git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175925 268f45cc-cd09-0410-ab3c-d52691b4dbfc
WebKit · Nov 11, 2014 · 3b1e460 · 3b1e460
1 parent c8ff663
commit 3b1e460
Show file tree

Hide file tree

Showing 7 changed files with 84 additions and 7 deletions.
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
@@ -1,3 +1,20 @@
+2014-10-24  Said Abou-Hallawa  <sabouhallawa@apple.com>
+
+        Clamp wordSpacing percentage value.
+        https://bugs.webkit.org/show_bug.cgi?id=129350.
+
+        Reviewed by Zalan Bujtas.
+
+        Make sure that setting the CSS style wordSpacing property to very huge percentage
+        value and blending this value with other values for animating key frames does
+        not assert or crash. The expectation is to have this huge value to be clamped to
+        the pre-defined min/max values for the CSS length type. So when blending the clamped
+        value with other wordSpacing values, the result can't be NaN. This should be very
+        similar to the case when it is set to a huge <length> value.
+
+        * css3/infinite-word-spacing-expected.txt: Added.
+        * css3/infinite-word-spacing.html: Added.
+
 2014-10-29  Zalan Bujtas  <zalan@apple.com>
 
         Remove invalid float from RootInlineBox.

diff --git a/LayoutTests/css3/infinite-word-spacing-expected.txt b/LayoutTests/css3/infinite-word-spacing-expected.txt
@@ -0,0 +1 @@
+PASS if no assert or crash in debug.
diff --git a/LayoutTests/css3/infinite-word-spacing.html b/LayoutTests/css3/infinite-word-spacing.html
@@ -0,0 +1,36 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <style>
+    h1 {
+        -webkit-animation-name: spacing;
+        -webkit-animation-duration: 1s;
+    }
+    @-webkit-keyframes spacing {
+      0%  {
+        word-spacing: normal
+      }
+      20%  {
+        word-spacing: 11111111111111111111111111111111111111111111111111%
+      }
+      40%  {
+        word-spacing: 1111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111%
+      }
+      60%  {
+        word-spacing: 200%
+      }
+      80%  {
+        word-spacing: 300%
+      }
+      100% { }
+    }
+  </style>
+</head>
+<script>
+if (window.testRunner)
+  testRunner.dumpAsText();
+</script>
+<body>
+<h1>PASS if no assert or crash in debug.</h1>
+</body>
+</html>
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
@@ -1,3 +1,26 @@
+2014-10-24  Said Abou-Hallawa  <sabouhallawa@apple.com>
+
+        Clamp wordSpacing percentage value.
+        https://bugs.webkit.org/show_bug.cgi?id=129350.
+
+        Reviewed by Zalan Bujtas.
+
+        When the CSS wordSpacing property is percentage, its value has to be within the
+        pre-defined min/max values for the CSS length type. This is done the same way
+        the wordSpacing of type <length> is handled.
+
+        Tests: css3/infinite-word-spacing.html.
+
+        Move the definitions of minValueForCssLength and maxValueForCssLength from the
+        .cpp file to the .h file.
+        * css/CSSPrimitiveValue.cpp:
+        * css/CSSPrimitiveValue.h:
+
+        Clamp the wordSpacing value to minValueForCssLength and maxValueForCssLength when
+        its type is percentage.
+        * css/DeprecatedStyleBuilder.cpp:
+        (WebCore::ApplyPropertyWordSpacing::applyValue):
+
 2014-10-24  Zalan Bujtas  <zalan@apple.com>
 
         Replace INT_MIN/MAX / kFixedPointDenominator with intMin/MaxForLayoutUnit.

diff --git a/Source/WebCore/css/CSSPrimitiveValue.cpp b/Source/WebCore/css/CSSPrimitiveValue.cpp
@@ -33,7 +33,6 @@
 #include "Counter.h"
 #include "ExceptionCode.h"
 #include "Font.h"
-#include "LayoutUnit.h"
 #include "Node.h"
 #include "Pair.h"
 #include "RGBColor.h"
@@ -59,11 +58,6 @@ using namespace WTF;
 
 namespace WebCore {
 
-// Max/min values for CSS, needs to slightly smaller/larger than the true max/min values to allow for rounding without overflowing.
-// Subtract two (rather than one) to allow for values to be converted to float and back without exceeding the LayoutUnit::max.
-const int maxValueForCssLength = intMaxForLayoutUnit - 2;
-const int minValueForCssLength = intMinForLayoutUnit + 2;
-
 static inline bool isValidCSSUnitTypeForDoubleConversion(CSSPrimitiveValue::UnitTypes unitType)
 {
     switch (unitType) {

diff --git a/Source/WebCore/css/CSSPrimitiveValue.h b/Source/WebCore/css/CSSPrimitiveValue.h
@@ -26,6 +26,7 @@
 #include "CSSValue.h"
 #include "CSSValueKeywords.h"
 #include "Color.h"
+#include "LayoutUnit.h"
 #include <wtf/Forward.h>
 #include <wtf/MathExtras.h>
 #include <wtf/PassRefPtr.h>
@@ -50,6 +51,11 @@ class LengthRepeat;
 struct Length;
 struct LengthSize;
 
+// Max/min values for CSS, needs to slightly smaller/larger than the true max/min values to allow for rounding without overflowing.
+// Subtract two (rather than one) to allow for values to be converted to float and back without exceeding the LayoutUnit::max.
+const int maxValueForCssLength = intMaxForLayoutUnit - 2;
+const int minValueForCssLength = intMinForLayoutUnit + 2;
+
 // Dimension calculations are imprecise, often resulting in values of e.g.
 // 44.99998. We need to go ahead and round if we're really close to the next
 // integer value.

diff --git a/Source/WebCore/css/DeprecatedStyleBuilder.cpp b/Source/WebCore/css/DeprecatedStyleBuilder.cpp
@@ -1557,7 +1557,7 @@ class ApplyPropertyWordSpacing {
         else if (primitiveValue->isLength()) {
             wordSpacing = primitiveValue->computeLength<Length>(csstoLengthConversionDataWithTextZoomFactor(*styleResolver));
         } else if (primitiveValue->isPercentage())
-            wordSpacing = Length(primitiveValue->getDoubleValue(), Percent);
+            wordSpacing = Length(clampTo<float>(primitiveValue->getDoubleValue(), minValueForCssLength, maxValueForCssLength), Percent);
         else if (primitiveValue->isNumber())
             wordSpacing = Length(primitiveValue->getDoubleValue(), Fixed);
         else