Code: bool TextAutosizer::processSubtree(RenderObject* layoutRoot)
{
    if (!m_document->settings() || !m_document->settings()->textAutosizingEnabled() || layoutRoot->view()->printing() || !m_document->page())
        return false;

    Frame* mainFrame = m_document->page()->mainFrame();

    TextAutosizingWindowInfo windowInfo;

     windowInfo.windowSize = m_document->settings()->textAutosizingWindowSizeOverride();
     if (windowInfo.windowSize.isEmpty()) {
         bool includeScrollbars = !InspectorInstrumentation::shouldApplyScreenWidthOverride(mainFrame);
        windowInfo.windowSize = mainFrame->view()->visibleContentRect(includeScrollbars).size(); // FIXME: Check that this is always in logical (density-independent) pixels (see wkbug.com/87440).
     }
 
    windowInfo.minLayoutSize = mainFrame->view()->layoutSize();
    for (Frame* frame = m_document->frame(); frame; frame = frame->tree()->parent()) {
        if (!frame->view()->isInChildFrameWithFrameFlattening())
            windowInfo.minLayoutSize = windowInfo.minLayoutSize.shrunkTo(frame->view()->layoutSize());
    }

    RenderBlock* container = layoutRoot->isRenderBlock() ? toRenderBlock(layoutRoot) : layoutRoot->containingBlock();
    while (container && !isAutosizingContainer(container))
        container = container->containingBlock();

    RenderBlock* cluster = container;
    while (cluster && (!isAutosizingContainer(cluster) || !isAutosizingCluster(cluster)))
        cluster = cluster->containingBlock();

    processCluster(cluster, container, layoutRoot, windowInfo);
    return true;
}

Vulnerability Type: DoS Overflow 
CWE ID: CWE-119
Summary: The PDF parser in Google Chrome before 16.0.912.63 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
Commit Message: Text Autosizing: Counteract funky window sizing on Android.
https://bugs.webkit.org/show_bug.cgi?id=98809

Reviewed by Adam Barth.

In Chrome for Android, the window sizes provided to WebCore are
currently in physical screen pixels instead of
device-scale-adjusted units. For example window width on a
Galaxy Nexus is 720 instead of 360.  Text autosizing expects
device-independent pixels.  When Chrome for Android cuts over to
the new coordinate space, it will be tied to the setting
applyPageScaleFactorInCompositor.

No new tests.

* rendering/TextAutosizer.cpp:
(WebCore::TextAutosizer::processSubtree):


git-svn-id: svn://svn.chromium.org/blink/trunk@130866 bbb929c8-8fbe-4397-9dbb-9b2b20218538