<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[168108] trunk</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/168108">168108</a></dd>
<dt>Author</dt> <dd>commit-queue@webkit.org</dd>
<dt>Date</dt> <dd>2014-05-01 10:48:38 -0700 (Thu, 01 May 2014)</dd>
</dl>

<h3>Log Message</h3>
<pre>[CSS Grid Layout] Clamping the number of repetitions in repeat()
https://bugs.webkit.org/show_bug.cgi?id=131023

Patch by Javier Fernandez &lt;jfernandez@igalia.com&gt; on 2014-05-01
Reviewed by Brent Fulgham.

Source/WebCore:
The ED suggests now to be able to clamp the number of repetitions when
using the repeat() function, taking precautions about excessive memory
usage.

The implemented max repetitions is 10K.

Test: fast/css-grid-layout/grid-element-repeat-max-repetitions.html

* css/CSSParser.cpp:
(WebCore::CSSParser::parseGridTrackRepeatFunction):

LayoutTests:
Test to ensure the number of repetitions used in the repeat() function
is clamped to 10K.

* fast/css-grid-layout/grid-element-repeat-max-repetitions-expected.txt: Added.
* fast/css-grid-layout/grid-element-repeat-max-repetitions.html: Added.</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCorecssCSSParsercpp">trunk/Source/WebCore/css/CSSParser.cpp</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsfastcssgridlayoutgridelementrepeatmaxrepetitionsexpectedtxt">trunk/LayoutTests/fast/css-grid-layout/grid-element-repeat-max-repetitions-expected.txt</a></li>
<li><a href="#trunkLayoutTestsfastcssgridlayoutgridelementrepeatmaxrepetitionshtml">trunk/LayoutTests/fast/css-grid-layout/grid-element-repeat-max-repetitions.html</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (168107 => 168108)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog        2014-05-01 17:26:24 UTC (rev 168107)
+++ trunk/LayoutTests/ChangeLog        2014-05-01 17:48:38 UTC (rev 168108)
</span><span class="lines">@@ -1,3 +1,16 @@
</span><ins>+2014-05-01  Javier Fernandez  &lt;jfernandez@igalia.com&gt;
+
+        [CSS Grid Layout] Clamping the number of repetitions in repeat()
+        https://bugs.webkit.org/show_bug.cgi?id=131023
+
+        Reviewed by Brent Fulgham.
+
+        Test to ensure the number of repetitions used in the repeat() function
+        is clamped to 10K.
+
+        * fast/css-grid-layout/grid-element-repeat-max-repetitions-expected.txt: Added.
+        * fast/css-grid-layout/grid-element-repeat-max-repetitions.html: Added.
+
</ins><span class="cx"> 2014-05-01  Commit Queue  &lt;commit-queue@webkit.org&gt;
</span><span class="cx"> 
</span><span class="cx">         Unreviewed, rolling out r167964.
</span></span></pre></div>
<a id="trunkLayoutTestsfastcssgridlayoutgridelementrepeatmaxrepetitionsexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/css-grid-layout/grid-element-repeat-max-repetitions-expected.txt (0 => 168108)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/css-grid-layout/grid-element-repeat-max-repetitions-expected.txt                                (rev 0)
+++ trunk/LayoutTests/fast/css-grid-layout/grid-element-repeat-max-repetitions-expected.txt        2014-05-01 17:48:38 UTC (rev 168108)
</span><span class="lines">@@ -0,0 +1,4 @@
</span><ins>+Test the values greater than the maximum repetitions value are clamped through CSS.
+PASS
+PASS
+PASS
</ins></span></pre></div>
<a id="trunkLayoutTestsfastcssgridlayoutgridelementrepeatmaxrepetitionshtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/css-grid-layout/grid-element-repeat-max-repetitions.html (0 => 168108)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/css-grid-layout/grid-element-repeat-max-repetitions.html                                (rev 0)
+++ trunk/LayoutTests/fast/css-grid-layout/grid-element-repeat-max-repetitions.html        2014-05-01 17:48:38 UTC (rev 168108)
</span><span class="lines">@@ -0,0 +1,35 @@
</span><ins>+&lt;!DOCTYPE html&gt;
+&lt;html&gt;
+&lt;head&gt;
+&lt;script&gt;
+if (window.testRunner)
+    testRunner.overridePreference(&quot;WebKitCSSGridLayoutEnabled&quot;, 1);
+&lt;/script&gt;
+&lt;link href=&quot;resources/grid.css&quot; rel=&quot;stylesheet&quot;&gt;
+&lt;style&gt;
+.clampRepetitionsBelowLimit {
+    -webkit-grid-template-rows: repeat(9995, 1px);
+}
+
+.clampRepetitionsOnLimit {
+    -webkit-grid-template-rows: repeat(10000, 1px);
+}
+
+.clampRepetitionsAboveLimit {
+    -webkit-grid-template-rows: repeat(10005, 1px);
+}
+&lt;/style&gt;
+&lt;script src=&quot;../../resources/check-layout.js&quot;&gt;&lt;/script&gt;
+&lt;/head&gt;
+&lt;body onload=&quot;checkLayout('.grid')&quot;&gt;
+
+&lt;div&gt;Test the values greater than the maximum repetitions value are clamped through CSS.&lt;/div&gt;
+
+&lt;div class=&quot;grid clampRepetitionsBelowLimit&quot; data-expected-height=&quot;9995&quot;&gt;&lt;/div&gt;
+
+&lt;div class=&quot;grid clampRepetitionsOnLimit&quot; data-expected-height=&quot;10000&quot;&gt;&lt;/div&gt;
+
+&lt;div class=&quot;grid clampRepetitionsAboveLimit&quot; data-expected-height=&quot;10000&quot;&gt;&lt;/div&gt;
+
+&lt;/body&gt;
+&lt;/html&gt;
</ins></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (168107 => 168108)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog        2014-05-01 17:26:24 UTC (rev 168107)
+++ trunk/Source/WebCore/ChangeLog        2014-05-01 17:48:38 UTC (rev 168108)
</span><span class="lines">@@ -1,3 +1,21 @@
</span><ins>+2014-05-01  Javier Fernandez  &lt;jfernandez@igalia.com&gt;
+
+        [CSS Grid Layout] Clamping the number of repetitions in repeat()
+        https://bugs.webkit.org/show_bug.cgi?id=131023
+
+        Reviewed by Brent Fulgham.
+
+        The ED suggests now to be able to clamp the number of repetitions when
+        using the repeat() function, taking precautions about excessive memory
+        usage.
+
+        The implemented max repetitions is 10K.
+
+        Test: fast/css-grid-layout/grid-element-repeat-max-repetitions.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseGridTrackRepeatFunction):
+
</ins><span class="cx"> 2014-04-30  Jer Noble  &lt;jer.noble@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         [MSE] Seeking between two buffered ranges enquues incorrect buffers.
</span></span></pre></div>
<a id="trunkSourceWebCorecssCSSParsercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/css/CSSParser.cpp (168107 => 168108)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/css/CSSParser.cpp        2014-05-01 17:26:24 UTC (rev 168107)
+++ trunk/Source/WebCore/css/CSSParser.cpp        2014-05-01 17:48:38 UTC (rev 168108)
</span><span class="lines">@@ -150,6 +150,7 @@
</span><span class="cx"> 
</span><span class="cx"> static const unsigned INVALID_NUM_PARSED_PROPERTIES = UINT_MAX;
</span><span class="cx"> static const double MAX_SCALE = 1000000;
</span><ins>+static const unsigned MAX_GRID_TRACK_REPETITIONS = 10000;
</ins><span class="cx"> 
</span><span class="cx"> template &lt;unsigned N&gt;
</span><span class="cx"> static bool equal(const CSSParserString&amp; a, const char (&amp;b)[N])
</span><span class="lines">@@ -5037,6 +5038,10 @@
</span><span class="cx"> 
</span><span class="cx">     ASSERT_WITH_SECURITY_IMPLICATION(arguments-&gt;valueAt(0)-&gt;fValue &gt; 0);
</span><span class="cx">     size_t repetitions = arguments-&gt;valueAt(0)-&gt;fValue;
</span><ins>+    // Clamp repetitions at MAX_GRID_TRACK_REPETITIONS.
+    // http://www.w3.org/TR/css-grid-1/#repeat-notation
+    if (repetitions &gt; MAX_GRID_TRACK_REPETITIONS)
+        repetitions = MAX_GRID_TRACK_REPETITIONS;
</ins><span class="cx">     RefPtr&lt;CSSValueList&gt; repeatedValues = CSSValueList::createSpaceSeparated();
</span><span class="cx">     arguments-&gt;next(); // Skip the repetition count.
</span><span class="cx">     arguments-&gt;next(); // Skip the comma.
</span></span></pre>
</div>
</div>

</body>
</html>