RESOLVED FIXED 126899
Subpixel layout: IntRect::infiniteRect() overflows when subpixel layout is enabled. 
https://bugs.webkit.org/show_bug.cgi?id=126899
Summary Subpixel layout: IntRect::infiniteRect() overflows when subpixel layout is en...
alan
Reported 2014-01-13 07:37:48 PST
svg/custom/masking-clipping-hidpi.svg
Attachments
Patch (3.21 KB, patch)
2014-01-18 10:17 PST, alan 		no flags
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
alan
Comment 1 2014-01-16 12:46:47 PST
overflow caused by IntRect::infiniteRect() (static IntRect infiniteRect(-std::numeric_limits<int>::max() / 2, -std::numeric_limits<int>::max() / 2, std::numeric_limits<int>::max(), std::numeric_limits<int>::max()); ) causes unexpected clipping -> missing content.
alan
Comment 2 2014-01-16 13:04:56 PST
This should help diff --git a/Source/WebCore/platform/graphics/IntRect.h b/Source/WebCore/platform/graphics/IntRect.h index 0a6d4aa..130fd83 100644 --- a/Source/WebCore/platform/graphics/IntRect.h +++ b/Source/WebCore/platform/graphics/IntRect.h @@ -27,6 +27,7 @@ #define IntRect_h #include "IntPoint.h" +#include "LayoutUnit.h" #include <wtf/Vector.h> #if USE(CG) @@ -236,7 +237,8 @@ inline bool operator!=(const IntRect& a, const IntRect& b) inline IntRect IntRect::infiniteRect() { - static IntRect infiniteRect(-std::numeric_limits<int>::max() / 2, -std::numeric_limits<int>::max() / 2, std::numeric_limits<int>::max(), std::numeric_limits<int>::max()); + static IntRect infiniteRect(-LayoutUnit::max() / 2, -LayoutUnit::max() / 2, LayoutUnit::max(), LayoutUnit::max()); return infiniteRect; }
Tim Horton
Comment 3 2014-01-16 13:56:39 PST
Oh, yes, one of the other ports noticed that we should do this (I didn't want to, but eventually became resigned to it) but closed their bug in a different way so I forgot about it. r+ if you post a patch.
alan
Comment 4 2014-01-18 10:17:29 PST
Created attachment 221555 [details] Patch
WebKit Commit Bot
Comment 5 2014-01-18 13:20:08 PST
Comment on attachment 221555 [details] Patch Clearing flags on attachment: 221555 Committed r162273: <http://trac.webkit.org/changeset/162273>
WebKit Commit Bot
Comment 6 2014-01-18 13:20:10 PST
All reviewed patches have been landed. Closing bug.
Sam Weinig
Comment 7 2014-01-19 10:51:36 PST
This doesn't sit right with me (why should something called infiniteRect() have anything to do with LayoutUnits?) Can we at least add a comment explaining this weirdness?
Note You need to log in before you can comment on or make changes to this bug.