Title: [275823] trunk
- Revision
- 275823
- Author
- [email protected]
- Date
- 2021-04-12 08:08:58 -0700 (Mon, 12 Apr 2021)
Log Message
Clamp overridingContentLogicalWidth/Height to zero
https://bugs.webkit.org/show_bug.cgi?id=224310
Patch by Rob Buis <[email protected]> on 2021-04-12
Reviewed by Sergio Villar Senin.
Source/WebCore:
Clamp overridingContentLogicalWidth/Height to zero.
Test: fast/css-grid-layout/negative-overriding-content-logical-height-crash.html
* rendering/RenderBox.h:
(WebCore::RenderBox::overridingContentLogicalWidth const):
(WebCore::RenderBox::overridingContentLogicalHeight const):
LayoutTests:
Add test for this.
* fast/css-grid-layout/negative-overriding-content-logical-height-crash-expected.txt: Added.
* fast/css-grid-layout/negative-overriding-content-logical-height-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (275822 => 275823)
--- trunk/LayoutTests/ChangeLog 2021-04-12 13:52:02 UTC (rev 275822)
+++ trunk/LayoutTests/ChangeLog 2021-04-12 15:08:58 UTC (rev 275823)
@@ -1,3 +1,15 @@
+2021-04-12 Rob Buis <[email protected]>
+
+ Clamp overridingContentLogicalWidth/Height to zero
+ https://bugs.webkit.org/show_bug.cgi?id=224310
+
+ Reviewed by Sergio Villar Senin.
+
+ Add test for this.
+
+ * fast/css-grid-layout/negative-overriding-content-logical-height-crash-expected.txt: Added.
+ * fast/css-grid-layout/negative-overriding-content-logical-height-crash.html: Added.
+
2021-04-12 Youenn Fablet <[email protected]>
[ macOS wk2 ] webrtc/libwebrtc/release-while-creating-offer.html is a flakey text failure
Added: trunk/LayoutTests/fast/css-grid-layout/negative-overriding-content-logical-height-crash-expected.txt (0 => 275823)
--- trunk/LayoutTests/fast/css-grid-layout/negative-overriding-content-logical-height-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/css-grid-layout/negative-overriding-content-logical-height-crash-expected.txt 2021-04-12 15:08:58 UTC (rev 275823)
@@ -0,0 +1 @@
+This test has PASSED if it does not CRASH.
Added: trunk/LayoutTests/fast/css-grid-layout/negative-overriding-content-logical-height-crash.html (0 => 275823)
--- trunk/LayoutTests/fast/css-grid-layout/negative-overriding-content-logical-height-crash.html (rev 0)
+++ trunk/LayoutTests/fast/css-grid-layout/negative-overriding-content-logical-height-crash.html 2021-04-12 15:08:58 UTC (rev 275823)
@@ -0,0 +1,28 @@
+<style>
+ script, html {
+ grid-template-rows: 0 0 1px repeat(auto-fit, 10px);
+ }
+ script {
+ overflow-y: hidden;
+ grid-gap: 100%;
+ }
+ style, script, head, html {
+ display: inline-grid;
+ }
+ style {
+ grid-column-start: 2;
+ }
+ :empty {
+ border-bottom: 5px solid;
+ }
+</style>
+<script>
+if (window.testRunner) {
+ testRunner.dumpAsText();
+ testRunner.waitUntilDone();
+}
+_onload_ = () => {
+ document.head.appendChild(document.createElement('script'));
+ setTimeout(function() { document.write('This test has PASSED if it does not CRASH.'); testRunner.notifyDone(); }, 0);
+};
+</script>
Modified: trunk/Source/WebCore/ChangeLog (275822 => 275823)
--- trunk/Source/WebCore/ChangeLog 2021-04-12 13:52:02 UTC (rev 275822)
+++ trunk/Source/WebCore/ChangeLog 2021-04-12 15:08:58 UTC (rev 275823)
@@ -1,3 +1,18 @@
+2021-04-12 Rob Buis <[email protected]>
+
+ Clamp overridingContentLogicalWidth/Height to zero
+ https://bugs.webkit.org/show_bug.cgi?id=224310
+
+ Reviewed by Sergio Villar Senin.
+
+ Clamp overridingContentLogicalWidth/Height to zero.
+
+ Test: fast/css-grid-layout/negative-overriding-content-logical-height-crash.html
+
+ * rendering/RenderBox.h:
+ (WebCore::RenderBox::overridingContentLogicalWidth const):
+ (WebCore::RenderBox::overridingContentLogicalHeight const):
+
2021-04-12 Philippe Normand <[email protected]>
[MSE][GStreamer] Crash in WebCore::PlaybackPipeline::addSourceBuffer when setting duration and preload is set to none
Modified: trunk/Source/WebCore/rendering/RenderBox.h (275822 => 275823)
--- trunk/Source/WebCore/rendering/RenderBox.h 2021-04-12 13:52:02 UTC (rev 275822)
+++ trunk/Source/WebCore/rendering/RenderBox.h 2021-04-12 15:08:58 UTC (rev 275823)
@@ -320,8 +320,8 @@
void clearOverridingLogicalHeight();
void clearOverridingLogicalWidth();
- LayoutUnit overridingContentLogicalWidth() const { return overridingLogicalWidth() - borderAndPaddingLogicalWidth() - scrollbarLogicalWidth(); }
- LayoutUnit overridingContentLogicalHeight() const { return overridingLogicalHeight() - borderAndPaddingLogicalHeight() - scrollbarLogicalHeight(); }
+ LayoutUnit overridingContentLogicalWidth() const { return std::max(LayoutUnit(), overridingLogicalWidth() - borderAndPaddingLogicalWidth() - scrollbarLogicalWidth()); }
+ LayoutUnit overridingContentLogicalHeight() const { return std::max(LayoutUnit(), overridingLogicalHeight() - borderAndPaddingLogicalHeight() - scrollbarLogicalHeight()); }
Optional<LayoutUnit> overridingContainingBlockContentWidth() const override;
Optional<LayoutUnit> overridingContainingBlockContentHeight() const override;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
