Changeset 273470 in webkit

Timestamp:

Feb 24, 2021 9:59:46 PM (17 months ago)

Author:

commit-queue@webkit.org

Message:

[css-grid] Do not allow negative heights
​https://bugs.webkit.org/show_bug.cgi?id=221439

Patch by Rob Buis <​rbuis@igalia.com> on 2021-02-24
Reviewed by Darin Adler.

Source/WebCore:

Do not allow negative heights in calculations, instead
use Optional to indicate that the heights are not existing.

Test: fast/css-grid-layout/zero-height-crash.html

• rendering/GridTrackSizingAlgorithm.cpp:

(WebCore::DefiniteSizeStrategy::minLogicalSizeForChild const):

• rendering/RenderBox.cpp:

(WebCore::RenderBox::replacedMinMaxLogicalHeightComputesAsNone const):

• rendering/RenderGrid.cpp:

(WebCore::RenderGrid::layoutBlock):
(WebCore::RenderGrid::gridGap const):
(WebCore::RenderGrid::placeItemsOnGrid const):
(WebCore::RenderGrid::applyStretchAlignmentToChildIfNeeded):

LayoutTests:

Add test for this.

• fast/css-grid-layout/zero-height-crash-expected.txt: Added.
• fast/css-grid-layout/zero-height-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/css-grid-layout/zero-height-crash-expected.txt (added)
• LayoutTests/fast/css-grid-layout/zero-height-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/rendering/GridTrackSizingAlgorithm.cpp (modified) (1 diff)
• Source/WebCore/rendering/RenderBox.cpp (modified) (1 diff)
• Source/WebCore/rendering/RenderGrid.cpp (modified) (4 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2021-02-24  Rob Buis  <rbuis@igalia.com>
+
+        [css-grid] Do not allow negative heights
+        https://bugs.webkit.org/show_bug.cgi?id=221439
+
+        Reviewed by Darin Adler.
+
+        Add test for this.
+
+        * fast/css-grid-layout/zero-height-crash-expected.txt: Added.
+        * fast/css-grid-layout/zero-height-crash.html: Added.
+
 2021-02-24  Imanol Fernandez  <ifernandez@igalia.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-02-24  Rob Buis  <rbuis@igalia.com>
+
+        [css-grid] Do not allow negative heights
+        https://bugs.webkit.org/show_bug.cgi?id=221439
+
+        Reviewed by Darin Adler.
+
+        Do not allow negative heights in calculations, instead
+        use Optional to indicate that the heights are not existing.
+
+        Test: fast/css-grid-layout/zero-height-crash.html
+
+        * rendering/GridTrackSizingAlgorithm.cpp:
+        (WebCore::DefiniteSizeStrategy::minLogicalSizeForChild const):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::replacedMinMaxLogicalHeightComputesAsNone const):
+        * rendering/RenderGrid.cpp:
+        (WebCore::RenderGrid::layoutBlock):
+        (WebCore::RenderGrid::gridGap const):
+        (WebCore::RenderGrid::placeItemsOnGrid const):
+        (WebCore::RenderGrid::applyStretchAlignmentToChildIfNeeded):
+
 2021-02-24  Julian Gonzalez  <julian_a_gonzalez@apple.com>
 

trunk/Source/WebCore/rendering/GridTrackSizingAlgorithm.cpp

@@ -1053 +1053 @@
 {
     GridTrackSizingDirection childInlineDirection = GridLayoutFunctions::flowAwareDirectionForChild(*renderGrid(), child, ForColumns);
-    LayoutUnit indefiniteSize = direction() == childInlineDirection ? LayoutUnit() : LayoutUnit(-1);
     GridTrackSizingDirection flowAwareDirection = GridLayoutFunctions::flowAwareDirectionForChild(*renderGrid(), child, direction());
-    if (hasRelativeMarginOrPaddingForChild(child, flowAwareDirection) || (direction() != childInlineDirection && hasRelativeOrIntrinsicSizeForChild(child, flowAwareDirection)))
-        setOverridingContainingBlockContentSizeForChild(child, direction(), indefiniteSize);
+    if (hasRelativeMarginOrPaddingForChild(child, flowAwareDirection) || (direction() != childInlineDirection && hasRelativeOrIntrinsicSizeForChild(child, flowAwareDirection))) {
+        Optional<LayoutUnit> overridingSize;
+        if (direction() == childInlineDirection)
+            overridingSize = 0_lu;
+        setOverridingContainingBlockContentSizeForChild(child, direction(), overridingSize);
+    }
     return GridTrackSizingAlgorithmStrategy::minLogicalSizeForChild(child, childMinSize, availableSize);
 }

trunk/Source/WebCore/rendering/RenderBox.cpp

@@ -3280 +3280 @@
     
     if (logicalHeight.isPercentOrCalculated() && hasOverridingContainingBlockContentLogicalHeight())
-        return overridingContainingBlockContentLogicalHeight() == LayoutUnit(-1);
+        return false;
 
     // Make sure % min-height and % max-height resolve to none if the containing block has auto height.

trunk/Source/WebCore/rendering/RenderGrid.cpp

@@ -251 +251 @@
             computeTrackSizesForIndefiniteSize(m_trackSizingAlgorithm, ForRows);
         else
-            computeTrackSizesForDefiniteSize(ForRows, availableLogicalHeight(ExcludeMarginBorderPadding));
+            computeTrackSizesForDefiniteSize(ForRows, std::max<LayoutUnit>(0_lu, availableLogicalHeight(ExcludeMarginBorderPadding)));
         LayoutUnit trackBasedLogicalHeight = m_trackSizingAlgorithm.computeTrackBasedSize() + borderAndPaddingLogicalHeight() + scrollbarLogicalHeight();
         setLogicalHeight(trackBasedLogicalHeight);
@@ -311 +311 @@
 LayoutUnit RenderGrid::gridGap(GridTrackSizingDirection direction, Optional<LayoutUnit> availableSize) const
 {
+    ASSERT(!availableSize || *availableSize >= 0);
     const GapLength& gapLength = direction == ForColumns? style().columnGap() : style().rowGap();
     if (gapLength.isNormal())
@@ -614 +615 @@
             child->setOverridingContainingBlockContentLogicalWidth(LayoutUnit());
         if (!child->hasOverridingContainingBlockContentLogicalHeight())
-            child->setOverridingContainingBlockContentLogicalHeight(LayoutUnit(-1));
+            child->setOverridingContainingBlockContentLogicalHeight(WTF::nullopt);
 
         GridArea area = grid.gridItemArea(*child);
@@ -1137 +1138 @@
     if (allowedToStretchChildBlockSize) {
         LayoutUnit stretchedLogicalHeight = availableAlignmentSpaceForChildBeforeStretching(GridLayoutFunctions::overridingContainingBlockContentSizeForChild(child, childBlockDirection).value(), child);
-        LayoutUnit desiredLogicalHeight = child.constrainLogicalHeightByMinMax(stretchedLogicalHeight, -1_lu);
+        LayoutUnit desiredLogicalHeight = child.constrainLogicalHeightByMinMax(stretchedLogicalHeight, WTF::nullopt);
         child.setOverridingLogicalHeight(desiredLogicalHeight);