<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[202489] trunk</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/202489">202489</a></dd>
<dt>Author</dt> <dd>fred.wang@free.fr</dd>
<dt>Date</dt> <dd>2016-06-27 10:36:09 -0700 (Mon, 27 Jun 2016)</dd>
</dl>
<h3>Log Message</h3>
<pre>Set an upper limit for the size or number of pieces of stretchy operators
https://bugs.webkit.org/show_bug.cgi?id=155434
Source/WebCore:
Patch by Frederic Wang <fwang@igalia.com> on 2016-06-27
Reviewed by Brent Fulgham.
Stretchy MathML operators can currently use an arbitrary number of extension glyphs to cover
a target size. This may result in hangs if large stretch sizes are requested. This change
only allow at most the 128 first extensions to be painted by the MathOperator class, which
should really be enough for mathematical formulas used in practice.
No new tests, already tested by very-large-stretchy-operators.
* rendering/mathml/MathOperator.cpp: Add a new kMaximumExtensionCount constant.
(WebCore::MathOperator::fillWithVerticalExtensionGlyph): Limit the number of step in this loop to kMaximumExtensionCount.
(WebCore::MathOperator::fillWithHorizontalExtensionGlyph): Ditto.
LayoutTests:
Update test expectations for very-large-stretchy-operators.
Patch by Frederic Wang <fwang@igalia.com> on 2016-06-27
Reviewed by Brent Fulgham.
* platform/efl/TestExpectations:
* platform/gtk/TestExpectations:
* platform/ios-simulator/TestExpectations:
* platform/mac/TestExpectations:
* platform/win/TestExpectations:</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkLayoutTestsplatformeflTestExpectations">trunk/LayoutTests/platform/efl/TestExpectations</a></li>
<li><a href="#trunkLayoutTestsplatformgtkTestExpectations">trunk/LayoutTests/platform/gtk/TestExpectations</a></li>
<li><a href="#trunkLayoutTestsplatformiossimulatorTestExpectations">trunk/LayoutTests/platform/ios-simulator/TestExpectations</a></li>
<li><a href="#trunkLayoutTestsplatformmacTestExpectations">trunk/LayoutTests/platform/mac/TestExpectations</a></li>
<li><a href="#trunkLayoutTestsplatformwinTestExpectations">trunk/LayoutTests/platform/win/TestExpectations</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCorerenderingmathmlMathOperatorcpp">trunk/Source/WebCore/rendering/mathml/MathOperator.cpp</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (202488 => 202489)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog 2016-06-27 17:33:38 UTC (rev 202488)
+++ trunk/LayoutTests/ChangeLog 2016-06-27 17:36:09 UTC (rev 202489)
</span><span class="lines">@@ -1,3 +1,18 @@
</span><ins>+2016-06-27 Frederic Wang <fwang@igalia.com>
+
+ Set an upper limit for the size or number of pieces of stretchy operators
+ https://bugs.webkit.org/show_bug.cgi?id=155434
+
+ Update test expectations for very-large-stretchy-operators.
+
+ Reviewed by Brent Fulgham.
+
+ * platform/efl/TestExpectations:
+ * platform/gtk/TestExpectations:
+ * platform/ios-simulator/TestExpectations:
+ * platform/mac/TestExpectations:
+ * platform/win/TestExpectations:
+
</ins><span class="cx"> 2016-06-27 Ryan Haddad <ryanhaddad@apple.com>
</span><span class="cx">
</span><span class="cx"> Skip two LayoutTests that rely on mouse events on ios-simulator
</span></span></pre></div>
<a id="trunkLayoutTestsplatformeflTestExpectations"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/platform/efl/TestExpectations (202488 => 202489)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/platform/efl/TestExpectations 2016-06-27 17:33:38 UTC (rev 202488)
+++ trunk/LayoutTests/platform/efl/TestExpectations 2016-06-27 17:36:09 UTC (rev 202489)
</span><span class="lines">@@ -762,8 +762,6 @@
</span><span class="cx"> webkit.org/b/136099 fast/events/scroll-event-during-modal-dialog.html [ Crash Timeout ]
</span><span class="cx"> webkit.org/b/136099 fast/harness/show-modal-dialog.html [ Crash Timeout ]
</span><span class="cx">
</span><del>-webkit.org/b/136227 mathml/very-large-stretchy-operators.html [ Crash Timeout Pass ]
-
</del><span class="cx"> #webkit.org/b/142158 inspector/dom/remove-multiple-nodes.html [ Crash Pass ]
</span><span class="cx"> #webkit.org/b/147018 inspector/css/get-system-fonts.html [ Skip ]
</span><span class="cx">
</span></span></pre></div>
<a id="trunkLayoutTestsplatformgtkTestExpectations"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/platform/gtk/TestExpectations (202488 => 202489)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/platform/gtk/TestExpectations 2016-06-27 17:33:38 UTC (rev 202488)
+++ trunk/LayoutTests/platform/gtk/TestExpectations 2016-06-27 17:36:09 UTC (rev 202489)
</span><span class="lines">@@ -1607,7 +1607,6 @@
</span><span class="cx"> webkit.org/b/141835 media/video-controls-no-scripting.html [ Failure ]
</span><span class="cx">
</span><span class="cx"> # May take too long on the bots.
</span><del>-Bug(GTK) mathml/very-large-stretchy-operators.html [ Pass Timeout ]
</del><span class="cx">
</span><span class="cx"> Bug(GTK) fast/history/go-back-to-iframe-with-plugin.html [ Timeout Pass ]
</span><span class="cx">
</span></span></pre></div>
<a id="trunkLayoutTestsplatformiossimulatorTestExpectations"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/platform/ios-simulator/TestExpectations (202488 => 202489)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/platform/ios-simulator/TestExpectations 2016-06-27 17:33:38 UTC (rev 202488)
+++ trunk/LayoutTests/platform/ios-simulator/TestExpectations 2016-06-27 17:36:09 UTC (rev 202489)
</span><span class="lines">@@ -2950,8 +2950,6 @@
</span><span class="cx"> webkit.org/b/155339 [ Debug ] imported/blink/fast/multicol/dynamic/multicol-with-abspos-svg-with-foreignobject-with-multicol-crash.html [ Pass Crash ]
</span><span class="cx"> webkit.org/b/155339 [ Debug ] imported/blink/fast/multicol/dynamic/relayout-abspos-in-relpos-spanner.html [ Pass Crash ]
</span><span class="cx">
</span><del>-webkit.org/b/155565 [ Debug ] mathml/very-large-stretchy-operators.html [ Skip ]
-
</del><span class="cx"> # RTL Scrollbars are not implemented on iOS.
</span><span class="cx"> fast/scrolling/rtl-scrollbars-sticky-document-2.html [ ImageOnlyFailure ]
</span><span class="cx"> fast/scrolling/rtl-scrollbars-sticky-document.html [ ImageOnlyFailure ]
</span></span></pre></div>
<a id="trunkLayoutTestsplatformmacTestExpectations"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/platform/mac/TestExpectations (202488 => 202489)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/platform/mac/TestExpectations 2016-06-27 17:33:38 UTC (rev 202488)
+++ trunk/LayoutTests/platform/mac/TestExpectations 2016-06-27 17:36:09 UTC (rev 202489)
</span><span class="lines">@@ -729,11 +729,6 @@
</span><span class="cx">
</span><span class="cx"> webkit.org/b/122038 animations/transform-non-accelerated.html [ Pass Failure ]
</span><span class="cx">
</span><del>-webkit.org/b/122490 [ Debug ] mathml/very-large-stretchy-operators.html [ Skip ]
-
-# rdar://problem/21443002
-[ Release ElCapitan+ ] mathml/very-large-stretchy-operators.html [ Slow ]
-
</del><span class="cx"> webkit.org/b/123220 compositing/regions/floated-region-with-transformed-child.html [ Pass ImageOnlyFailure ]
</span><span class="cx"> webkit.org/b/138179 compositing/regions/propagate-region-box-shadow-border-padding-for-video.html [ Skip ]
</span><span class="cx">
</span></span></pre></div>
<a id="trunkLayoutTestsplatformwinTestExpectations"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/platform/win/TestExpectations (202488 => 202489)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/platform/win/TestExpectations 2016-06-27 17:33:38 UTC (rev 202488)
+++ trunk/LayoutTests/platform/win/TestExpectations 2016-06-27 17:36:09 UTC (rev 202489)
</span><span class="lines">@@ -1964,7 +1964,6 @@
</span><span class="cx"> mathml/opentype/opentype-stretchy-horizontal.html [ Skip ] # Crashing
</span><span class="cx"> mathml/presentation/style-changed.html [ Crash Pass ]
</span><span class="cx"> webkit.org/b/140522 mathml/opentype/munderover-layout-resize.html [ Skip ] # Crashing
</span><del>-mathml/very-large-stretchy-operators.html [ Skip ]
</del><span class="cx"> ################################################################################
</span><span class="cx"> ################# End MathML Issues ####################
</span><span class="cx"> ################################################################################
</span></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (202488 => 202489)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog 2016-06-27 17:33:38 UTC (rev 202488)
+++ trunk/Source/WebCore/ChangeLog 2016-06-27 17:36:09 UTC (rev 202489)
</span><span class="lines">@@ -1,3 +1,21 @@
</span><ins>+2016-06-27 Frederic Wang <fwang@igalia.com>
+
+ Set an upper limit for the size or number of pieces of stretchy operators
+ https://bugs.webkit.org/show_bug.cgi?id=155434
+
+ Reviewed by Brent Fulgham.
+
+ Stretchy MathML operators can currently use an arbitrary number of extension glyphs to cover
+ a target size. This may result in hangs if large stretch sizes are requested. This change
+ only allow at most the 128 first extensions to be painted by the MathOperator class, which
+ should really be enough for mathematical formulas used in practice.
+
+ No new tests, already tested by very-large-stretchy-operators.
+
+ * rendering/mathml/MathOperator.cpp: Add a new kMaximumExtensionCount constant.
+ (WebCore::MathOperator::fillWithVerticalExtensionGlyph): Limit the number of step in this loop to kMaximumExtensionCount.
+ (WebCore::MathOperator::fillWithHorizontalExtensionGlyph): Ditto.
+
</ins><span class="cx"> 2016-06-27 Frederic Wang <fred.wang@free.fr>
</span><span class="cx">
</span><span class="cx"> Small refactoring MathMLInlineContainerElement::createElementRenderer
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingmathmlMathOperatorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/mathml/MathOperator.cpp (202488 => 202489)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/mathml/MathOperator.cpp 2016-06-27 17:33:38 UTC (rev 202488)
+++ trunk/Source/WebCore/rendering/mathml/MathOperator.cpp 2016-06-27 17:36:09 UTC (rev 202489)
</span><span class="lines">@@ -32,6 +32,7 @@
</span><span class="cx"> #include "StyleInheritedData.h"
</span><span class="cx">
</span><span class="cx"> static const unsigned kRadicalOperator = 0x221A;
</span><ins>+static const unsigned kMaximumExtensionCount = 128;
</ins><span class="cx">
</span><span class="cx"> namespace WebCore {
</span><span class="cx">
</span><span class="lines">@@ -490,9 +491,8 @@
</span><span class="cx"> LayoutPoint glyphOrigin = LayoutPoint(from.x(), from.y() - offsetToGlyphTop);
</span><span class="cx"> FloatRect lastPaintedGlyphRect(from, FloatSize());
</span><span class="cx">
</span><del>- // FIXME: In practice, only small stretch sizes are requested but we may need to limit the number
- // of pieces that can be repeated to avoid hangs. See http://webkit.org/b/155434
- while (lastPaintedGlyphRect.maxY() < to.y()) {
</del><ins>+ // In practice, only small stretch sizes are requested but we limit the number of glyphs to avoid hangs.
+ for (unsigned extensionCount = 0; lastPaintedGlyphRect.maxY() < to.y() && extensionCount < kMaximumExtensionCount; extensionCount++) {
</ins><span class="cx"> lastPaintedGlyphRect = paintGlyph(style, info, m_assembly.extension, glyphOrigin, TrimTopAndBottom);
</span><span class="cx"> glyphOrigin.setY(glyphOrigin.y() + lastPaintedGlyphRect.height());
</span><span class="cx">
</span><span class="lines">@@ -529,9 +529,8 @@
</span><span class="cx"> LayoutPoint glyphOrigin = LayoutPoint(from.x() + offsetToGlyphLeft, from.y());
</span><span class="cx"> FloatRect lastPaintedGlyphRect(from, FloatSize());
</span><span class="cx">
</span><del>- // FIXME: In practice, only small stretch sizes are requested but we may need to limit the number
- // of pieces that can be repeated to avoid hangs. See http://webkit.org/b/155434
- while (lastPaintedGlyphRect.maxX() < to.x()) {
</del><ins>+ // In practice, only small stretch sizes are requested but we limit the number of glyphs to avoid hangs.
+ for (unsigned extensionCount = 0; lastPaintedGlyphRect.maxX() < to.x() && extensionCount < kMaximumExtensionCount; extensionCount++) {
</ins><span class="cx"> lastPaintedGlyphRect = paintGlyph(style, info, m_assembly.extension, glyphOrigin, TrimLeftAndRight);
</span><span class="cx"> glyphOrigin.setX(glyphOrigin.x() + lastPaintedGlyphRect.width());
</span><span class="cx">
</span></span></pre>
</div>
</div>
</body>
</html>