Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2025-02-05 22:05:40 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 552334. Deal with z-indices whose difference overflows a 32-bit signed int. r=roc

Browse Source
This commit is contained in:
Boris Zbarsky 2010-04-01 22:09:05 -04:00
parent e2c52c0a30
commit 2b60b98a59
4 changed files with 48 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
layout/base/nsDisplayList.cpp
View File

@ -974,12 +974,13 @@ static PRBool IsContentLEQ(nsDisplayItem* aItem1, nsDisplayItem* aItem2,
static PRBool IsZOrderLEQ(nsDisplayItem* aItem1, nsDisplayItem* aItem2,
void* aClosure) {
// These GetUnderlyingFrame calls return non-null because we're only used
// in sorting
PRInt32 diff = nsLayoutUtils::GetZIndex(aItem1->GetUnderlyingFrame()) -
nsLayoutUtils::GetZIndex(aItem2->GetUnderlyingFrame());
if (diff == 0)
// in sorting. Note that we can't just take the difference of the two
// z-indices here, because that might overflow a 32-bit int.
PRInt32 index1 = nsLayoutUtils::GetZIndex(aItem1->GetUnderlyingFrame());
PRInt32 index2 = nsLayoutUtils::GetZIndex(aItem2->GetUnderlyingFrame());
if (index1 == index2)
return IsContentLEQ(aItem1, aItem2, aClosure);
return diff < 0;
return index1 < index2;
}
void nsDisplayList::ExplodeAnonymousChildLists(nsDisplayListBuilder* aBuilder) {

15
layout/reftests/bugs/552334-1-ref.html Normal file
View File

@ -0,0 +1,15 @@
<!DOCTYPE html>
<html>
<head>
<style>
div { position: absolute; top: 0; left: 0; width: 100px; height: 100px; }
div.offset { left: 100px; }
div.offset2 { left: 200px; }
</style>
</head>
<body>
<div style="background: green"></div>
<div class="offset" style="background: green"></div>
<div class="offset2" style="background: green"></div>
</body>
</html>

26
layout/reftests/bugs/552334-1.html Normal file
View File

@ -0,0 +1,26 @@
<!DOCTYPE html>
<html>
<head>
<style>
div { position: absolute; top: 0; left: 0; width: 100px; height: 100px; }
div.offset { left: 100px; }
div.offset2 { left: 200px; }
</style>
</head>
<body>
<!-- Make sure the difference of the two z-index values overflows a 32-bit
signed int. So set the positive one to 2^30 + 1 and the negative one to
-(2^30 + 1). Then the difference is 2^31 + 2 which is negative when
treated as a 32-bit signed int. -->
<div style="background: green; z-index: 1073741825"></div>
<div style="background: red; z-index: -1073741825"></div>
<!-- Test clamping on the high end by setting the high z-index to
2^32 + 1 -->
<div class="offset" style="background: green; z-index: 4294967297"></div>
<div class="offset" style="background: red; z-index: 2"></div>
<!-- Test clamping on the low end by setting the low z-index to
-(2^32 + 1) -->
<div class="offset2" style="background: green; z-index: -2"></div>
<div class="offset2" style="background: red; z-index: -4294967297"></div>
</body>
</html>

1
layout/reftests/bugs/reftest.list
View File

@ -1417,4 +1417,5 @@ random-if(!haveTestPlugin) == 546071-1.html 546071-1-ref.html
== 549184-1.html 549184-1-ref.html
== 550716-1.html 550716-1-ref.html
== 551463-1.html 551463-1-ref.html
== 552334-1.html 552334-1-ref.html
== 551699-1.html 551699-1-ref.html