Changeset 236133 in webkit

Timestamp:

Sep 18, 2018, 8:39:47 AM (8 years ago)

Author:

Carlos Garcia Campos

Message:

Merge r235590 - REGRESSION (r191336): RenderFlexibleBox::adjustChildSizeForMinAndMax crashes in std::optional<>::value()
​https://bugs.webkit.org/show_bug.cgi?id=189232
<rdar://problem/43886373>

Reviewed by Brent Fulgham.

Source/WebCore:

It's not guaranteed that RenderFlexibleBox::computeMainAxisExtentForChild() always returns with a valid value.

Test: fast/flexbox/crash-when-min-max-content-is-not-computed.html

• rendering/RenderFlexibleBox.cpp:

(WebCore::RenderFlexibleBox::adjustChildSizeForMinAndMax):

LayoutTests:

• fast/flexbox/crash-when-min-max-content-is-not-computed-expected.txt: Added.
• fast/flexbox/crash-when-min-max-content-is-not-computed.html: Added.

Location:

releases/WebKitGTK/webkit-2.22

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/flexbox/crash-when-min-max-content-is-not-computed-expected.txt (added)
• LayoutTests/fast/flexbox/crash-when-min-max-content-is-not-computed.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/rendering/RenderFlexibleBox.cpp (modified) (2 diffs)

releases/WebKitGTK/webkit-2.22/LayoutTests/ChangeLog

@@ +1 @@
+2018-09-02  Zalan Bujtas  <zalan@apple.com>
+
+        REGRESSION (r191336): RenderFlexibleBox::adjustChildSizeForMinAndMax crashes in std::optional<>::value()
+        https://bugs.webkit.org/show_bug.cgi?id=189232
+        <rdar://problem/43886373>
+
+        Reviewed by Brent Fulgham.
+
+        * fast/flexbox/crash-when-min-max-content-is-not-computed-expected.txt: Added.
+        * fast/flexbox/crash-when-min-max-content-is-not-computed.html: Added.
+
 2018-08-31  John Wilander  <wilander@apple.com>
 

releases/WebKitGTK/webkit-2.22/Source/WebCore/ChangeLog

@@ +1 @@
+2018-09-02  Zalan Bujtas  <zalan@apple.com>
+
+        REGRESSION (r191336): RenderFlexibleBox::adjustChildSizeForMinAndMax crashes in std::optional<>::value()
+        https://bugs.webkit.org/show_bug.cgi?id=189232
+        <rdar://problem/43886373>
+
+        Reviewed by Brent Fulgham.
+
+        It's not guaranteed that RenderFlexibleBox::computeMainAxisExtentForChild() always returns with a valid value.
+
+        Test: fast/flexbox/crash-when-min-max-content-is-not-computed.html
+
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::adjustChildSizeForMinAndMax):
+
 2018-08-31  Jer Noble  <jer.noble@apple.com>
 

releases/WebKitGTK/webkit-2.22/Source/WebCore/rendering/RenderFlexibleBox.cpp

@@ -1088 +1088 @@
         // produces reasonable results. Tracking bug: https://crbug.com/581553
         // css-flexbox section 4.5
-        LayoutUnit contentSize = computeMainAxisExtentForChild(child, MinSize, Length(MinContent)).value();
+        // FIXME: If the min value is expected to be valid here, we need to come up with a non optional version of computeMainAxisExtentForChild and
+        // ensure it's valid through the virtual calls of computeIntrinsicLogicalContentHeightUsing.
+        LayoutUnit contentSize = computeMainAxisExtentForChild(child, MinSize, Length(MinContent)).value_or(0);
         ASSERT(contentSize >= 0);
         if (child.hasAspectRatio() && child.intrinsicSize().height() > 0)
@@ -1096 +1098 @@
         Length mainSize = isHorizontalFlow() ? child.style().width() : child.style().height();
         if (mainAxisLengthIsDefinite(child, mainSize)) {
-            LayoutUnit resolvedMainSize = computeMainAxisExtentForChild(child, MainOrPreferredSize, mainSize).value();
+            LayoutUnit resolvedMainSize = computeMainAxisExtentForChild(child, MainOrPreferredSize, mainSize).value_or(0);
             ASSERT(resolvedMainSize >= 0);
             LayoutUnit specifiedSize = std::min(resolvedMainSize, maxExtent.value_or(resolvedMainSize));