Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(26)

Issues Search
    My Issues | Starred     Open | Closed | All

Issue 2518163002: [css-tables] Fix divide-by-zero resulting from 32-bit overflow (Closed)

Created:
4 years, 1 month ago by dgrogan
Modified:
4 years ago
CC:
chromium-reviews, pdr+renderingwatchlist_chromium.org, szager+layoutwatch_chromium.org, zoltan1, blink-reviews-layout_chromium.org, blink-reviews-html_chromium.org, eae+blinkwatch, leviw+renderwatch, dglazkov+blink, jchaffraix+rendering, blink-reviews
Target Ref:
refs/pending/heads/master
Project:
chromium
Visibility:
Public.

Description

[css-tables] Fix divide-by-zero resulting from 32-bit overflow When col/colgroup spans added up to exactly 2^32, the result would overflow to 0, which was the divisor for a later operation. This patch clamps col spans to 8190, matching cell colspans. This makes the problem harder to trigger but doesn't eliminate it. BUG=660581 Committed: https://crrev.com/e47aea373e0ec97912b63c51797650dc55311336 Cr-Commit-Position: refs/heads/master@{#439041}

Patch Set 1 : with layout test #

Total comments: 11

Patch Set 2 : ToT #

Patch Set 3 : respond to comments #

Patch Set 4 : update wpt -expected.txt and span-attribute.html but not -expected.txt #

Messages

Total messages: 23 (13 generated)
dgrogan
Hi Morten, As the description says, this patch doesn't eliminate the problem. But to trigger ...
4 years, 1 month ago (2016-11-22 00:35:31 UTC) #2
mstensho (USE GERRIT)
lgtm https://codereview.chromium.org/2518163002/diff/20001/third_party/WebKit/LayoutTests/fast/table/large-col-span-crash.html File third_party/WebKit/LayoutTests/fast/table/large-col-span-crash.html (right): https://codereview.chromium.org/2518163002/diff/20001/third_party/WebKit/LayoutTests/fast/table/large-col-span-crash.html#newcode1 third_party/WebKit/LayoutTests/fast/table/large-col-span-crash.html:1: <!doctype html> Could turn this into a testharness ...
4 years, 1 month ago (2016-11-22 07:04:29 UTC) #3
dgrogan
https://codereview.chromium.org/2518163002/diff/20001/third_party/WebKit/LayoutTests/fast/table/large-col-span-crash.html File third_party/WebKit/LayoutTests/fast/table/large-col-span-crash.html (right): https://codereview.chromium.org/2518163002/diff/20001/third_party/WebKit/LayoutTests/fast/table/large-col-span-crash.html#newcode1 third_party/WebKit/LayoutTests/fast/table/large-col-span-crash.html:1: <!doctype html> On 2016/11/22 07:04:29, mstensho wrote: > Could ...
4 years ago (2016-12-01 21:51:45 UTC) #5
commit-bot: I haz the power
CQ is trying da patch. Follow status at https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.org/2518163002/60001
4 years ago (2016-12-01 21:52:10 UTC) #8
commit-bot: I haz the power
Try jobs failed on following builders: win_chromium_rel_ng on master.tryserver.chromium.win (JOB_FAILED, http://build.chromium.org/p/tryserver.chromium.win/builders/win_chromium_rel_ng/builds/342289)
4 years ago (2016-12-01 23:38:47 UTC) #10
mstensho (USE GERRIT)
@dgrogan Looks like all you have to do is update a couple of tests?
4 years ago (2016-12-06 19:53:52 UTC) #11
dgrogan
On 2016/12/06 19:53:52, mstensho wrote: > @dgrogan Looks like all you have to do is ...
4 years ago (2016-12-16 01:03:23 UTC) #15
commit-bot: I haz the power
CQ is trying da patch. Follow status at https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.org/2518163002/140001
4 years ago (2016-12-16 01:07:46 UTC) #18
commit-bot: I haz the power
Committed patchset #4 (id:140001)
4 years ago (2016-12-16 06:10:25 UTC) #21
commit-bot: I haz the power
4 years ago (2016-12-16 06:14:38 UTC) #23
Message was sent while issue was closed. 
Patchset 4 (id:??) landed as
https://crrev.com/e47aea373e0ec97912b63c51797650dc55311336
Cr-Commit-Position: refs/heads/master@{#439041}

Powered by Google App Engine
This is Rietveld 408576698