[Webkit-unassigned] [Bug 68744] New: Column width calculation wraps an unsigned int

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=68744

           Summary: Column width calculation wraps an unsigned int
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: Layout and Rendering
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: leviw at google.com
                CC: hyatt at apple.com, bdakin at apple.com, koivisto at iki.fi,
                    simon.fraser at apple.com, jamesr at chromium.org,
                    eae at chromium.org, leviw at chromium.org


Load fast/block/float/float-not-removed-from-next-sibling4.html
Notice the horizontal scrollbar. If you're no a debug build, you'll also notice scrolling all the way to the right results in the debug red fill.

To see what's happening, look at the following line in RenderBlock::calcColumnWidth (RenderBlock's too big for a trac link):
desiredColumnWidth = max<int>(0, (availWidth - ((desiredColumnCount - 1) * colGap)) / desiredColumnCount);

desiredColumnCount is unsigned, and the compiler implicitly converts the other parameters to unsigned despite being ints. The end result is a massive number. Explicitly making desiredColumnCount an int fixes this issue, but breaks the test (the image no longer paints because the column width is incorrectly zero).

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.