Changeset 175314 in webkit

Timestamp:

Oct 29, 2014 1:30:39 AM (9 years ago)

Author:

svillar@igalia.com

Message:

ASSERTION FAILED: growthShare > 0 in WebCore::RenderGrid::distributeSpaceToTracks
​https://bugs.webkit.org/show_bug.cgi?id=137772

Reviewed by Andreas Kling.

Source/WebCore:

We're hitting the ASSERTION because if the number of tracks an
item spans does greatly exceed the available logical space, then
the result of the division availableLogicalSpace/numberOfTracks is
truncated to 0. So the ASSERTION was theoretically right because
the result has to be always >0 (as the dividend > 0) but the fact
that the result is a LayoutUnit forces us to accept 0 as a valid
outcome of the operation.

Test: fast/css-grid-layout/tracks-number-greatly-exceeding-available-size-crash.html

• rendering/RenderGrid.cpp:

(WebCore::RenderGrid::distributeSpaceToTracks):

LayoutTests:

• fast/css-grid-layout/tracks-number-greatly-exceeding-available-size-crash-expected.txt: Added.
• fast/css-grid-layout/tracks-number-greatly-exceeding-available-size-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/css-grid-layout/tracks-number-greatly-exceeding-available-size-crash-expected.txt (added)
• LayoutTests/fast/css-grid-layout/tracks-number-greatly-exceeding-available-size-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/rendering/RenderGrid.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2014-10-17  Sergio Villar Senin  <svillar@igalia.com>
+
+        ASSERTION FAILED: growthShare > 0 in WebCore::RenderGrid::distributeSpaceToTracks
+        https://bugs.webkit.org/show_bug.cgi?id=137772
+
+        Reviewed by Andreas Kling.
+
+        * fast/css-grid-layout/tracks-number-greatly-exceeding-available-size-crash-expected.txt: Added.
+        * fast/css-grid-layout/tracks-number-greatly-exceeding-available-size-crash.html: Added.
+
 2014-10-29  Chris Dumez  <cdumez@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2014-10-17  Sergio Villar Senin  <svillar@igalia.com>
+
+        ASSERTION FAILED: growthShare > 0 in WebCore::RenderGrid::distributeSpaceToTracks
+        https://bugs.webkit.org/show_bug.cgi?id=137772
+
+        Reviewed by Andreas Kling.
+
+        We're hitting the ASSERTION because if the number of tracks an
+        item spans does greatly exceed the available logical space, then
+        the result of the division availableLogicalSpace/numberOfTracks is
+        truncated to 0. So the ASSERTION was theoretically right because
+        the result has to be always >0 (as the dividend > 0) but the fact
+        that the result is a LayoutUnit forces us to accept 0 as a valid
+        outcome of the operation.
+
+        Test: fast/css-grid-layout/tracks-number-greatly-exceeding-available-size-crash.html
+
+        * rendering/RenderGrid.cpp:
+        (WebCore::RenderGrid::distributeSpaceToTracks):
+
 2014-10-29  Chris Dumez  <cdumez@apple.com>
 

trunk/Source/WebCore/rendering/RenderGrid.cpp

@@ -651 +651 @@
             LayoutUnit availableLogicalSpaceShare = availableLogicalSpace / (tracksSize - i);
             LayoutUnit growthShare = infiniteGrowthPotential ? availableLogicalSpaceShare : std::min(availableLogicalSpaceShare, trackGrowthPotential);
-            ASSERT(growthShare > 0);
-            // We should never shrink any grid track or else we can't guarantee we abide by our min-sizing function.
+            ASSERT_WITH_MESSAGE(growthShare >= 0, "We should never shrink any grid track or else we can't guarantee we abide by our min-sizing function. We can still have 0 as growthShare if the amount of tracks greatly exceeds the availableLogicalSpace.");
             sizingData.distributeTrackVector[i] += growthShare;
             availableLogicalSpace -= growthShare;