Merge from Chromium at DEPS revision 33.0.1750.146
This commit was generated by merge_to_master.py.
Change-Id: Id825d3b68ff29f0d889dc4fc782ff921d79f1401
diff --git a/Source/core/css/CSSParserValues.h b/Source/core/css/CSSParserValues.h
index 7d423e7..8efd325 100644
--- a/Source/core/css/CSSParserValues.h
+++ b/Source/core/css/CSSParserValues.h
@@ -262,7 +262,10 @@
{
id = CSSValueInvalid;
isInt = false;
- fValue = value;
+ if (std::isfinite(value))
+ fValue = value;
+ else
+ fValue = 0;
this->unit = unit;
}
diff --git a/Source/core/svg/graphics/SVGImage.cpp b/Source/core/svg/graphics/SVGImage.cpp
index ff2a77e..5526ab7 100644
--- a/Source/core/svg/graphics/SVGImage.cpp
+++ b/Source/core/svg/graphics/SVGImage.cpp
@@ -120,13 +120,13 @@
SVGSVGElement* rootElement = toSVGDocument(frame->document())->rootElement();
if (!rootElement)
return;
- RenderSVGRoot* renderer = toRenderSVGRoot(rootElement->renderer());
- if (!renderer)
- return;
FrameView* view = frameView();
view->resize(this->containerSize());
+ RenderSVGRoot* renderer = toRenderSVGRoot(rootElement->renderer());
+ if (!renderer)
+ return;
renderer->setContainerSize(size);
}
diff --git a/Source/wtf/text/StringBuilder.cpp b/Source/wtf/text/StringBuilder.cpp
index 56f4cac..0e3d82d 100644
--- a/Source/wtf/text/StringBuilder.cpp
+++ b/Source/wtf/text/StringBuilder.cpp
@@ -32,10 +32,10 @@
namespace WTF {
-static size_t expandedCapacity(size_t capacity, size_t newLength)
+static unsigned expandedCapacity(unsigned capacity, unsigned requiredLength)
{
- static const size_t minimumCapacity = 16;
- return std::max(capacity, std::max(minimumCapacity, newLength * 2));
+ static const unsigned minimumCapacity = 16;
+ return std::max(requiredLength, std::max(minimumCapacity, capacity * 2));
}
void StringBuilder::reifyString()
diff --git a/Source/wtf/text/StringBuilder.h b/Source/wtf/text/StringBuilder.h
index 3f78ed0..62417d9 100644
--- a/Source/wtf/text/StringBuilder.h
+++ b/Source/wtf/text/StringBuilder.h
@@ -94,7 +94,8 @@
if (!string.length())
return;
- if ((offset + length) > string.length())
+ unsigned extent = offset + length;
+ if (extent < offset || extent > string.length())
return;
if (string.is8Bit())
