[Webkit-unassigned] [Bug 119273] New: Arithmetic overflow when computing max-height CSS property with subpixel layout

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=119273

           Summary: Arithmetic overflow when computing max-height CSS
                    property with subpixel layout
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: UNCONFIRMED
          Severity: Normal
          Priority: P2
         Component: CSS
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: jfernandez at igalia.com


First of all, I think this bug affects all the platforms/ports, since it was detected while looking into the bug #118595 which affects all the ports enabling SUBPIXEL_LAYOUT flag by default.

Secondly, The bug is not reproducible if the SATURATED_LAYOUT_ARITHMETIC flag is enabled, at least for the WebKitGtk+ port.

Finally, when debugging the test provided by the bug #118595, I found out that the max-height CSS property is handled by the WebCore::CSSPrimitiveValue::computeLength<WebCore::Length> method, which, when using SUBPIXEL_LAYOUT, the property value of 2000000000px is passed through the MathExtras::clampTo<float> function with [min, max] = [-33554430, 33554429]. 

At some point in the layout process, the RenderBox::constrainLogicalHeightByMinMax method is called, causing the arithmetic overflow when adjusting the box borders at RenderBox::adjustBorderBoxLogicalHeightForBoxSizing while computing the height + bordersPlusPadding operation, being height the style()->logicalMaxHeight().

Clearly, the SATURATED_LAYOUT_ARITHMETIC support will avoid this overflow, since the "+" operator uses the "saturatedAddition", but I guess it would be also possible to protect the adjustBorderBoxLogicalHeightForBoxSizing method to avoid the problem. However, I tend to think that using SUBPIXEL_LAYOUT without the SATURATED_LAYOUT_ARITHMETIC is a risk in terms of this kind of arithmetic overflow.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.