[Webkit-unassigned] [Bug 94317] New: Counter values not clamped on integer overflow

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=94317

           Summary: Counter values not clamped on integer overflow
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: All
        OS/Version: All
            Status: NEW
          Keywords: EasyFix, HasReduction
          Severity: Normal
          Priority: P2
         Component: Layout and Rendering
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: esprehn at chromium.org


We clamp the summation of the values in a counter-increment on integer overflow but we don't do this when you have two counters in a row:

div:before { counter-increment: 2147483647; /* MAX_INT */ }

<div></div>
<div></div>

See: https://trac.webkit.org/changeset/102528

Should be an easy fix of adding the attached test and using clampToInteger in RenderCounter.cpp

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.