Don't overflow in LayoutText::width() on a huge length.

third_party/WebKit/Source/core/layout/LayoutTextTest.cpp

Index: third_party/WebKit/Source/core/layout/LayoutTextTest.cpp
diff --git a/third_party/WebKit/Source/core/layout/LayoutTextTest.cpp b/third_party/WebKit/Source/core/layout/LayoutTextTest.cpp
new file mode 100644
index 0000000000000000000000000000000000000000..7584beb2427c6d6adb31fecbef4cf1ff1ebe1af8
--- /dev/null
+++ b/third_party/WebKit/Source/core/layout/LayoutTextTest.cpp
@@ -0,0 +1,87 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "core/layout/LayoutText.h"
+
+#include "core/layout/LayoutTestHelper.h"
+#include "core/layout/line/InlineTextBox.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace blink {
+
+namespace {
+
+class LayoutTextTest : public RenderingTest {
+public:
+    void setBasicBody(const char* message)
+    {
+        setBodyInnerHTML(String::format("<div id='target' style='font-size: 10px;'>%s</div>", message));
+    }
+
+    LayoutText* getBasicText()
+    {
+        return toLayoutText(getLayoutObjectByElementId("target")->slowFirstChild());
+    }
+};
+
+const char* kTacoText = "Los Compadres Taco Truck";
+
+} // namespace
+
+TEST_F(LayoutTextTest, WidthZeroFromZeroLength)
+{
+    setBasicBody(kTacoText);
+    ASSERT_EQ(0, getBasicText()->width(0u, 0u, LayoutUnit(), LTR, false));
+}
+
+TEST_F(LayoutTextTest, WidthMaxFromZeroLength)
+{
+    setBasicBody(kTacoText);
+    ASSERT_EQ(0, getBasicText()->width(USHRT_MAX, 0u, LayoutUnit(), LTR, false));
+}
+
+TEST_F(LayoutTextTest, WidthZeroFromMaxLength)
+{
+    setBasicBody(kTacoText);
+    float width = getBasicText()->width(0u, USHRT_MAX, LayoutUnit(), LTR, false);
+    // Width may vary by platform and we just want to make sure it's something roughly reasonable.
+    ASSERT_GE(width, 120.f);
+    ASSERT_LE(width, 160.f);
+}
+
+TEST_F(LayoutTextTest, WidthMaxFromMaxLength)
+{
+    setBasicBody(kTacoText);
+    ASSERT_EQ(0, getBasicText()->width(USHRT_MAX, USHRT_MAX, LayoutUnit(), LTR, false));
+}
+
+TEST_F(LayoutTextTest, WidthWithHugeLengthAvoidsOverflow)
+{
+    // The test case from http://crbug.com/647820 uses a 288-length string, so for posterity we follow that closely.
+    setBodyInnerHTML("<div id='target'>xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
+        "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
+        "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
+        "</div>");
+    // Width may vary by platform and we just want to make sure it's something roughly reasonable.
+    float width = getBasicText()->width(23u, 4294967282u, LayoutUnit(2.59375), RTL, false);
+    ASSERT_GE(width, 200.f);
+    ASSERT_LE(width, 300.f);
+}
+
+TEST_F(LayoutTextTest, WidthFromBeyondLength)
+{
+    setBasicBody("x");
+    ASSERT_EQ(0u, getBasicText()->width(1u, 1u, LayoutUnit(), LTR, false));
+}
+
+TEST_F(LayoutTextTest, WidthLengthBeyondLength)
+{
+    setBasicBody("x");
+    // Width may vary by platform and we just want to make sure it's something roughly reasonable.
+    float width = getBasicText()->width(0u, 2u, LayoutUnit(), LTR, false);
+    ASSERT_GE(width, 4.f);
+    ASSERT_LE(width, 20.f);
+}
+
+} // namespace blink