summaryrefslogtreecommitdiffstats
path: root/Source/WebCore/html/HTMLCanvasElement.cpp
diff options
context:
space:
mode:
authorBen Murdoch <benm@google.com>2011-07-13 10:14:36 +0100
committerBen Murdoch <benm@google.com>2011-07-13 11:03:14 +0100
commitd0147a863b872ecaa451ab0dce2a348760e99e2c (patch)
treeb4819830b7ab03f384ed8ab83734ac0f46193263 /Source/WebCore/html/HTMLCanvasElement.cpp
parent65b45b34343dc5d5b9dbeda52e9de428e146c8f7 (diff)
downloadexternal_webkit-d0147a863b872ecaa451ab0dce2a348760e99e2c.zip
external_webkit-d0147a863b872ecaa451ab0dce2a348760e99e2c.tar.gz
external_webkit-d0147a863b872ecaa451ab0dce2a348760e99e2c.tar.bz2
Merge WebKit at branches/chromium/742 r89068: Initial merge by Git.
Take us to top of Chrome 12 release branch (12.0.742.130) Change-Id: I4408a97e343a118cf4a1bb9d71367bcc2c16ae48
Diffstat (limited to 'Source/WebCore/html/HTMLCanvasElement.cpp')
-rw-r--r--Source/WebCore/html/HTMLCanvasElement.cpp16
1 files changed, 10 insertions, 6 deletions
diff --git a/Source/WebCore/html/HTMLCanvasElement.cpp b/Source/WebCore/html/HTMLCanvasElement.cpp
index ff94b76..764620c 100644
--- a/Source/WebCore/html/HTMLCanvasElement.cpp
+++ b/Source/WebCore/html/HTMLCanvasElement.cpp
@@ -372,17 +372,21 @@ PassRefPtr<ImageData> HTMLCanvasElement::getImageData()
IntRect HTMLCanvasElement::convertLogicalToDevice(const FloatRect& logicalRect) const
{
- float left = floorf(logicalRect.x() * m_pageScaleFactor);
- float top = floorf(logicalRect.y() * m_pageScaleFactor);
- float right = ceilf(logicalRect.maxX() * m_pageScaleFactor);
- float bottom = ceilf(logicalRect.maxY() * m_pageScaleFactor);
-
+ // Prevent under/overflow by ensuring the rect's bounds stay within integer-expressible range
+ int left = clampToInteger(floorf(logicalRect.x() * m_pageScaleFactor));
+ int top = clampToInteger(floorf(logicalRect.y() * m_pageScaleFactor));
+ int right = clampToInteger(ceilf(logicalRect.maxX() * m_pageScaleFactor));
+ int bottom = clampToInteger(ceilf(logicalRect.maxY() * m_pageScaleFactor));
+
return IntRect(IntPoint(left, top), convertToValidDeviceSize(right - left, bottom - top));
}
IntSize HTMLCanvasElement::convertLogicalToDevice(const FloatSize& logicalSize) const
{
- return convertToValidDeviceSize(logicalSize.width() * m_pageScaleFactor, logicalSize.height() * m_pageScaleFactor);
+ // Prevent overflow by ensuring the rect's bounds stay within integer-expressible range
+ float width = clampToInteger(ceilf(logicalSize.width() * m_pageScaleFactor));
+ float height = clampToInteger(ceilf(logicalSize.height() * m_pageScaleFactor));
+ return convertToValidDeviceSize(width, height);
}
IntSize HTMLCanvasElement::convertToValidDeviceSize(float width, float height) const