Changeset 179826 in webkit

Timestamp:

Feb 9, 2015 6:05:49 AM (9 years ago)

Author:

svillar@igalia.com

Message:

ASSERTION FAILED: resolvedInitialPosition <= resolvedFinalPosition in WebCore::GridSpan::GridSpan
​https://bugs.webkit.org/show_bug.cgi?id=141328

Reviewed by Darin Adler.

.:

Added as manual test because it involves a huge grid allocation
which is very slow on Debug bots, the only ones capable to trigger
the assertion.

• ManualTests/css-grid-layout-item-with-huge-span-crash.html: Added.

Source/WebCore:

Whenever
GridResolvedPosition::resolveGridPositionsFromAutoPlacementPosition()
was trying to place an item with span, it was completely ignoring
the resolvedInitialPosition returned by
GridResolvedPosition::resolveGridPositionAgainstOppositePosition()
and only using the finalResolvedPosition. This works with an
unlimited grid which can indefinitely grow. But if the item spans
over the grid track limits, then it might happen that the final
resolved position is placed before the initial resolved position,
something that is forbidden.

The solution is to directly use the GridSpan returned by
GridResolvedPosition::resolveGridPositionAgainstOppositePosition(), if the item
does not surpass the track limits then the returned initialResolvedPosition
is identical to the provided one, otherwise it's properly corrected to respect
track boundaries.

• rendering/style/GridResolvedPosition.cpp:

(WebCore::GridResolvedPosition::resolveGridPositionsFromAutoPlacementPosition):

Location:

trunk

Files:

• ChangeLog (modified) (1 diff)
• ManualTests/css-grid-layout-item-with-huge-span-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/rendering/style/GridResolvedPosition.cpp (modified) (1 diff)

trunk/ChangeLog

@@ +1 @@
+2015-02-09  Sergio Villar Senin  <svillar@igalia.com>
+
+        ASSERTION FAILED: resolvedInitialPosition <= resolvedFinalPosition in WebCore::GridSpan::GridSpan
+        https://bugs.webkit.org/show_bug.cgi?id=141328
+
+        Reviewed by Darin Adler.
+
+        Added as manual test because it involves a huge grid allocation
+        which is very slow on Debug bots, the only ones capable to trigger
+        the assertion.
+
+        * ManualTests/css-grid-layout-item-with-huge-span-crash.html: Added.
+
 2015-02-05  Youenn Fablet  <youenn.fablet@crf.canon.fr> and Xabier Rodriguez Calvar <calvaris@igalia.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2015-02-06  Sergio Villar Senin  <svillar@igalia.com>
+
+        ASSERTION FAILED: resolvedInitialPosition <= resolvedFinalPosition in WebCore::GridSpan::GridSpan
+        https://bugs.webkit.org/show_bug.cgi?id=141328
+
+        Reviewed by Darin Adler.
+
+        Whenever
+        GridResolvedPosition::resolveGridPositionsFromAutoPlacementPosition()
+        was trying to place an item with span, it was completely ignoring
+        the resolvedInitialPosition returned by
+        GridResolvedPosition::resolveGridPositionAgainstOppositePosition()
+        and only using the finalResolvedPosition. This works with an
+        unlimited grid which can indefinitely grow. But if the item spans
+        over the grid track limits, then it might happen that the final
+        resolved position is placed before the initial resolved position,
+        something that is forbidden.
+
+        The solution is to directly use the GridSpan returned by
+        GridResolvedPosition::resolveGridPositionAgainstOppositePosition(), if the item
+        does not surpass the track limits then the returned initialResolvedPosition
+        is identical to the provided one, otherwise it's properly corrected to respect
+        track boundaries.
+
+        * rendering/style/GridResolvedPosition.cpp:
+        (WebCore::GridResolvedPosition::resolveGridPositionsFromAutoPlacementPosition):
+
 2015-01-22  Sergio Villar Senin  <svillar@igalia.com>
 

trunk/Source/WebCore/rendering/style/GridResolvedPosition.cpp

@@ -79 +79 @@
 
     if (initialPosition.isSpan())
-        resolvedFinalPosition = resolveGridPositionAgainstOppositePosition(gridContainerStyle, resolvedInitialPosition, initialPosition, finalPositionSide)->resolvedFinalPosition;
+        return *resolveGridPositionAgainstOppositePosition(gridContainerStyle, resolvedInitialPosition, initialPosition, finalPositionSide);
     else if (finalPosition.isSpan())
-        resolvedFinalPosition = resolveGridPositionAgainstOppositePosition(gridContainerStyle, resolvedInitialPosition, finalPosition, finalPositionSide)->resolvedFinalPosition;
+        return *resolveGridPositionAgainstOppositePosition(gridContainerStyle, resolvedInitialPosition, finalPosition, finalPositionSide);
 
     return GridSpan(resolvedInitialPosition, resolvedFinalPosition);