Title: [235590] trunk
- Revision
- 235590
- Author
- [email protected]
- Date
- 2018-09-02 20:41:11 -0700 (Sun, 02 Sep 2018)
Log Message
REGRESSION (r191336): RenderFlexibleBox::adjustChildSizeForMinAndMax crashes in std::optional<>::value()
https://bugs.webkit.org/show_bug.cgi?id=189232
<rdar://problem/43886373>
Reviewed by Brent Fulgham.
Source/WebCore:
It's not guaranteed that RenderFlexibleBox::computeMainAxisExtentForChild() always returns with a valid value.
Test: fast/flexbox/crash-when-min-max-content-is-not-computed.html
* rendering/RenderFlexibleBox.cpp:
(WebCore::RenderFlexibleBox::adjustChildSizeForMinAndMax):
LayoutTests:
* fast/flexbox/crash-when-min-max-content-is-not-computed-expected.txt: Added.
* fast/flexbox/crash-when-min-max-content-is-not-computed.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (235589 => 235590)
--- trunk/LayoutTests/ChangeLog 2018-09-02 16:41:45 UTC (rev 235589)
+++ trunk/LayoutTests/ChangeLog 2018-09-03 03:41:11 UTC (rev 235590)
@@ -1,3 +1,14 @@
+2018-09-02 Zalan Bujtas <[email protected]>
+
+ REGRESSION (r191336): RenderFlexibleBox::adjustChildSizeForMinAndMax crashes in std::optional<>::value()
+ https://bugs.webkit.org/show_bug.cgi?id=189232
+ <rdar://problem/43886373>
+
+ Reviewed by Brent Fulgham.
+
+ * fast/flexbox/crash-when-min-max-content-is-not-computed-expected.txt: Added.
+ * fast/flexbox/crash-when-min-max-content-is-not-computed.html: Added.
+
2018-09-02 Yusuke Suzuki <[email protected]>
Implement Object.fromEntries
Added: trunk/LayoutTests/fast/flexbox/crash-when-min-max-content-is-not-computed-expected.txt (0 => 235590)
--- trunk/LayoutTests/fast/flexbox/crash-when-min-max-content-is-not-computed-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/flexbox/crash-when-min-max-content-is-not-computed-expected.txt 2018-09-03 03:41:11 UTC (rev 235590)
@@ -0,0 +1,2 @@
+PASS if no crash.
+
Added: trunk/LayoutTests/fast/flexbox/crash-when-min-max-content-is-not-computed.html (0 => 235590)
--- trunk/LayoutTests/fast/flexbox/crash-when-min-max-content-is-not-computed.html (rev 0)
+++ trunk/LayoutTests/fast/flexbox/crash-when-min-max-content-is-not-computed.html 2018-09-03 03:41:11 UTC (rev 235590)
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+.outer {
+ display: flex;
+ flex-direction: column;
+}
+
+.inner{
+ display: grid;
+ height: 100px;
+}
+</style>
+</head>
+PASS if no crash.
+<div class=outer><div class=inner></div></div>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+</script>
+</html>
\ No newline at end of file
Modified: trunk/Source/WebCore/ChangeLog (235589 => 235590)
--- trunk/Source/WebCore/ChangeLog 2018-09-02 16:41:45 UTC (rev 235589)
+++ trunk/Source/WebCore/ChangeLog 2018-09-03 03:41:11 UTC (rev 235590)
@@ -1,3 +1,18 @@
+2018-09-02 Zalan Bujtas <[email protected]>
+
+ REGRESSION (r191336): RenderFlexibleBox::adjustChildSizeForMinAndMax crashes in std::optional<>::value()
+ https://bugs.webkit.org/show_bug.cgi?id=189232
+ <rdar://problem/43886373>
+
+ Reviewed by Brent Fulgham.
+
+ It's not guaranteed that RenderFlexibleBox::computeMainAxisExtentForChild() always returns with a valid value.
+
+ Test: fast/flexbox/crash-when-min-max-content-is-not-computed.html
+
+ * rendering/RenderFlexibleBox.cpp:
+ (WebCore::RenderFlexibleBox::adjustChildSizeForMinAndMax):
+
2018-09-01 Simon Fraser <[email protected]>
Rename FilterEffectRenderer to CSSFilter
Modified: trunk/Source/WebCore/rendering/RenderFlexibleBox.cpp (235589 => 235590)
--- trunk/Source/WebCore/rendering/RenderFlexibleBox.cpp 2018-09-02 16:41:45 UTC (rev 235589)
+++ trunk/Source/WebCore/rendering/RenderFlexibleBox.cpp 2018-09-03 03:41:11 UTC (rev 235590)
@@ -1087,7 +1087,9 @@
// https://drafts.csswg.org/css-flexbox/#intrinsic-sizes before that
// produces reasonable results. Tracking bug: https://crbug.com/581553
// css-flexbox section 4.5
- LayoutUnit contentSize = computeMainAxisExtentForChild(child, MinSize, Length(MinContent)).value();
+ // FIXME: If the min value is expected to be valid here, we need to come up with a non optional version of computeMainAxisExtentForChild and
+ // ensure it's valid through the virtual calls of computeIntrinsicLogicalContentHeightUsing.
+ LayoutUnit contentSize = computeMainAxisExtentForChild(child, MinSize, Length(MinContent)).value_or(0);
ASSERT(contentSize >= 0);
if (child.hasAspectRatio() && child.intrinsicSize().height() > 0)
contentSize = adjustChildSizeForAspectRatioCrossAxisMinAndMax(child, contentSize);
@@ -1095,7 +1097,7 @@
Length mainSize = isHorizontalFlow() ? child.style().width() : child.style().height();
if (mainAxisLengthIsDefinite(child, mainSize)) {
- LayoutUnit resolvedMainSize = computeMainAxisExtentForChild(child, MainOrPreferredSize, mainSize).value();
+ LayoutUnit resolvedMainSize = computeMainAxisExtentForChild(child, MainOrPreferredSize, mainSize).value_or(0);
ASSERT(resolvedMainSize >= 0);
LayoutUnit specifiedSize = std::min(resolvedMainSize, maxExtent.value_or(resolvedMainSize));
return std::max(childSize, std::min(specifiedSize, contentSize));
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
