Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: e10f76756319604596dad0ab29f5676732c18846
https://github.com/WebKit/WebKit/commit/e10f76756319604596dad0ab29f5676732c18846
Author: Kristian Monsen <[email protected]>
Date: 2026-08-08 (Sat, 08 Aug 2026)
Changed paths:
A
LayoutTests/fast/css-grid-layout/grid-auto-rows-percentage-intrinsic-width-crash-expected.txt
A
LayoutTests/fast/css-grid-layout/grid-auto-rows-percentage-intrinsic-width-crash.html
M Source/WebCore/layout/formattingContexts/grid/GridFormattingContext.cpp
Log Message:
-----------
[GFC] Convert percentages in grid-auto-rows/grid-auto-columns to auto when
computing intrinsic grid container size
https://bugs.webkit.org/show_bug.cgi?id=321353
rdar://184019251
Reviewed by Sammy Gill.
The crash happens because rowSizesForFirstIterationColumnSizing
(GridLayout.cpp:391-423) assumes every row track's percentage sizing function
has already been converted to auto
before it runs. Its own comment says as much, and the ASSERT at line 399
documents that assumption directly: "The formatting context should have
transformed this track size to
auto." When a row track is still a raw Percentage at that point, the function
unconditionally dereferences the optional gridContainerInnerInlineSize, which
is only empty in exactly
this situation.
That assumption was correctly upheld for grid-template-columns and
grid-template-rows. The helper gridTemplateListWithPercentagesConvertedToAuto
was already applied to both, in
both computeIntrinsicWidths and layout. But it was silently not upheld for
grid-auto-columns and grid-auto-rows, which were passed through to
GridDefinition untouched. Since
implicit tracks are sized from grid-auto-rows and grid-auto-columns
(generateImplicitTrackSizingFunctions, GridLayout.cpp:346), any grid whose rows
are entirely implicit, including
the common case of an empty explicit grid as in the crash testcase, could carry
a raw percentage all the way into rowSizesForFirstIterationColumnSizing, with
the container's
inline size still indefinite because the code is in the middle of computing
that container's own intrinsic width. The precondition the code was written to
depend on simply never
held for this input.
The fix closes that gap by applying the exact same percentage-to-auto
conversion to grid-auto-columns and grid-auto-rows that already existed for the
template lists, in the same
two call sites and under the same conditions. In layout, the conversion is
gated on inlineAxisDependsOnTracks and blockAxisDependsOnTracks. In
computeIntrinsicWidths, it is applied
unconditionally, since intrinsic sizing is always against an indefinite
constraint. Once grid-auto-rows: 0% is converted to auto before reaching
GridLayout,
rowSizesForFirstIterationColumnSizing takes the Auto branch at line 412 instead
of the Percentage branch, and that branch returns LayoutUnit::max() without
touching
gridContainerInnerInlineSize at all.
The ASSERT's precondition is now actually satisfied, so the fix is not "handle
the null case defensively," which would just convert a clean crash into
silently wrong track sizing.
It is "make sure the data reaching this code matches what the code was always
written to assume." That is also exactly what the CSS Grid spec requires:
percentage track sizes must
resolve as auto whenever the axis they depend on is indefinite, and that rule
applies equally to grid-template-* and grid-auto-*, not just the former.
Test: fast/css-grid-layout/grid-auto-rows-percentage-intrinsic-width-crash.html
*
LayoutTests/fast/css-grid-layout/grid-auto-rows-percentage-intrinsic-width-crash-expected.txt:
Added.
*
LayoutTests/fast/css-grid-layout/grid-auto-rows-percentage-intrinsic-width-crash.html:
Added.
* Source/WebCore/layout/formattingContexts/grid/GridFormattingContext.cpp:
(WebCore::Layout::gridAutoTrackSizesWithPercentagesConvertedToAuto):
(WebCore::Layout::GridFormattingContext::layout):
(WebCore::Layout::GridFormattingContext::computeIntrinsicWidths):
Canonical link: https://commits.webkit.org/318842@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
