Changeset 274933 in webkit

Timestamp:

Mar 24, 2021 12:44:20 AM (16 months ago)

Author:

commit-queue@webkit.org

Message:

[css-grid] Do not allow negative heights
​https://bugs.webkit.org/show_bug.cgi?id=221439

Patch by Rob Buis <​rbuis@igalia.com> on 2021-03-24
Reviewed by Javier Fernandez.

Source/WebCore:

Do not allow negative heights in calculations.

Test: fast/css-grid-layout/zero-height-crash.html

• rendering/GridTrackSizingAlgorithm.cpp:

(WebCore::GridTrackSizingAlgorithm::setup):

• rendering/GridTrackSizingAlgorithm.h:
• rendering/RenderGrid.cpp:

(WebCore::RenderGrid::computeTrackSizesForDefiniteSize):
(WebCore::RenderGrid::gridGap const):
(WebCore::RenderGrid::computeTrackSizesForIndefiniteSize const):
(WebCore::RenderGrid::availableAlignmentSpaceForChildBeforeStretching const):

LayoutTests:

Add test for this.

• fast/css-grid-layout/zero-height-crash-expected.txt: Added.
• fast/css-grid-layout/zero-height-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/css-grid-layout/zero-height-crash-expected.txt (added)
• LayoutTests/fast/css-grid-layout/zero-height-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/rendering/GridTrackSizingAlgorithm.cpp (modified) (2 diffs)
• Source/WebCore/rendering/GridTrackSizingAlgorithm.h (modified) (1 diff)
• Source/WebCore/rendering/RenderGrid.cpp (modified) (4 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2021-03-24  Rob Buis  <rbuis@igalia.com>
+
+        [css-grid] Do not allow negative heights
+        https://bugs.webkit.org/show_bug.cgi?id=221439
+
+        Reviewed by Javier Fernandez.
+
+        Add test for this.
+
+        * fast/css-grid-layout/zero-height-crash-expected.txt: Added.
+        * fast/css-grid-layout/zero-height-crash.html: Added.
+
 2021-03-23  Lauro Moura  <lmoura@igalia.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-03-24  Rob Buis  <rbuis@igalia.com>
+
+        [css-grid] Do not allow negative heights
+        https://bugs.webkit.org/show_bug.cgi?id=221439
+
+        Reviewed by Javier Fernandez.
+
+        Do not allow negative heights in calculations.
+
+        Test: fast/css-grid-layout/zero-height-crash.html
+
+        * rendering/GridTrackSizingAlgorithm.cpp:
+        (WebCore::GridTrackSizingAlgorithm::setup):
+        * rendering/GridTrackSizingAlgorithm.h:
+        * rendering/RenderGrid.cpp:
+        (WebCore::RenderGrid::computeTrackSizesForDefiniteSize):
+        (WebCore::RenderGrid::gridGap const):
+        (WebCore::RenderGrid::computeTrackSizesForIndefiniteSize const):
+        (WebCore::RenderGrid::availableAlignmentSpaceForChildBeforeStretching const):
+
 2021-03-23  Tim Horton  <timothy_horton@apple.com>
 

trunk/Source/WebCore/rendering/GridTrackSizingAlgorithm.cpp

@@ -1269 +1269 @@
 // GridTrackSizingAlgorithm API.
 
-void GridTrackSizingAlgorithm::setup(GridTrackSizingDirection direction, unsigned numTracks, SizingOperation sizingOperation, Optional<LayoutUnit> availableSpace, Optional<LayoutUnit> freeSpace)
+void GridTrackSizingAlgorithm::setup(GridTrackSizingDirection direction, unsigned numTracks, SizingOperation sizingOperation, Optional<LayoutUnit> availableSpace)
 {
     ASSERT(m_needsSetup);
     m_direction = direction;
-    setAvailableSpace(direction, availableSpace);
+    setAvailableSpace(direction, availableSpace ? std::max(0_lu, *availableSpace) : availableSpace);
 
     m_sizingOperation = sizingOperation;
@@ -1289 +1289 @@
     m_autoSizedTracksForStretchIndex.shrink(0);
 
-    setFreeSpace(direction, freeSpace);
+    if (availableSpace) {
+        LayoutUnit guttersSize = m_renderGrid->guttersSize(m_grid, direction, 0, m_grid.numTracks(direction), this->availableSpace(direction));
+        setFreeSpace(direction, *availableSpace - guttersSize);
+    } else
+        setFreeSpace(direction, WTF::nullopt);
     tracks(direction).resize(numTracks);
 

trunk/Source/WebCore/rendering/GridTrackSizingAlgorithm.h

@@ -106 +106 @@
     }
 
-    void setup(GridTrackSizingDirection, unsigned numTracks, SizingOperation, Optional<LayoutUnit> availableSpace, Optional<LayoutUnit> freeSpace);
+    void setup(GridTrackSizingDirection, unsigned numTracks, SizingOperation, Optional<LayoutUnit> availableSpace);
     void run();
     void reset();

trunk/Source/WebCore/rendering/RenderGrid.cpp

@@ -146 +146 @@
 void RenderGrid::computeTrackSizesForDefiniteSize(GridTrackSizingDirection direction, LayoutUnit availableSpace)
 {
-    LayoutUnit totalGuttersSize = guttersSize(m_grid, direction, 0, m_grid.numTracks(direction), availableSpace);
-    LayoutUnit freeSpace = availableSpace - totalGuttersSize;
-
-    m_trackSizingAlgorithm.setup(direction, numTracks(direction, m_grid), TrackSizing, availableSpace, freeSpace);
+    m_trackSizingAlgorithm.setup(direction, numTracks(direction, m_grid), TrackSizing, availableSpace);
     m_trackSizingAlgorithm.run();
 
@@ -317 +314 @@
 LayoutUnit RenderGrid::gridGap(GridTrackSizingDirection direction, Optional<LayoutUnit> availableSize) const
 {
+    ASSERT(!availableSize || *availableSize >= 0);
     const GapLength& gapLength = direction == ForColumns? style().columnGap() : style().rowGap();
     if (gapLength.isNormal())
@@ -440 +438 @@
 {
     const Grid& grid = algorithm.grid();
-    algorithm.setup(direction, numTracks(direction, grid), IntrinsicSizeComputation, WTF::nullopt, WTF::nullopt);
+    algorithm.setup(direction, numTracks(direction, grid), IntrinsicSizeComputation, WTF::nullopt);
     algorithm.run();
 
@@ -1112 +1110 @@
     // compute margins in order to determine the available height before stretching.
     GridTrackSizingDirection childBlockFlowDirection = GridLayoutFunctions::flowAwareDirectionForChild(*this, child, ForRows);
-    return gridAreaBreadthForChild - GridLayoutFunctions::marginLogicalSizeForChild(*this, childBlockFlowDirection, child);
+    return std::max(0_lu, gridAreaBreadthForChild - GridLayoutFunctions::marginLogicalSizeForChild(*this, childBlockFlowDirection, child));
 }