[webkit-reviews] review denied: [Bug 237376] Ensure delta lengths are positive : [Attachment 453630] Patch

[bugzilla-daemon at webkit.org]

Simon Fraser (smfr) <simon.fraser at apple.com> has denied Brandon
<brandonstewart at apple.com>'s request for review:
Bug 237376: Ensure delta lengths are positive
https://bugs.webkit.org/show_bug.cgi?id=237376

Attachment 453630: Patch

https://bugs.webkit.org/attachment.cgi?id=453630&action=review




--- Comment #2 from Simon Fraser (smfr) <simon.fraser at apple.com> ---
Comment on attachment 453630
  --> https://bugs.webkit.org/attachment.cgi?id=453630
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=453630&action=review

> Source/WebCore/rendering/RenderText.cpp:1297
> -    int delta = newText.length() - text().length();
> +    unsigned delta = std::abs(static_cast<int>(newText.length() -
text().length()));

This doesn't seem right. dirtyRange() is written to accept negative delta
values; see the assertion in offsetRun().

This clamping needs to be more nuanced somehow.