WebKit Bugzilla
Attachment 348734 Details for
Bug 189232
: REGRESSION (r191336): RenderFlexibleBox::adjustChildSizeForMinAndMax crashes in std::optional<>::value()
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Requests
|
Help
|
New Account
|
Log In
Remember
[x]
|
Forgot Password
Login:
[x]
[patch]
Patch
bug-189232-20180902092515.patch (text/plain), 4.93 KB, created by
zalan
on 2018-09-02 09:25:19 PDT
(
hide
)
Description:
Patch
Filename:
MIME Type:
Creator:
zalan
Created:
2018-09-02 09:25:19 PDT
Size:
4.93 KB
patch
obsolete
>Subversion Revision: 235561 >diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog >index 419ea9c99c654386a88bd8fff3fa07b0c6c2a1f5..e9c188fa495c207b9128d26789f326c51f015688 100644 >--- a/Source/WebCore/ChangeLog >+++ b/Source/WebCore/ChangeLog >@@ -1,3 +1,21 @@ >+2018-09-02 Zalan Bujtas <zalan@apple.com> >+ >+ REGRESSION (r191336): RenderFlexibleBox::adjustChildSizeForMinAndMax crashes in std::optional<>::value() >+ https://bugs.webkit.org/show_bug.cgi?id=189232 >+ <rdar://problem/43886373> >+ >+ Reviewed by NOBODY (OOPS!). >+ >+ It's not guaranteed that RenderFlexibleBox::computeMainAxisExtentForChild() always returns with a valid value. >+ >+ However if min/max value are expected to be valid here, we need to come up with a non optional version of this function and >+ ensure valid values through the virtual calls of computeIntrinsicLogicalContentHeightUsing. >+ >+ Test: fast/flexbox/crash-when-min-max-content-is-not-computed.html >+ >+ * rendering/RenderFlexibleBox.cpp: >+ (WebCore::RenderFlexibleBox::adjustChildSizeForMinAndMax): >+ > 2018-08-31 Zalan Bujtas <zalan@apple.com> > > [LFC] Add margin box verification back now that Display::Box has non-computed horizontal margin. >diff --git a/Source/WebCore/rendering/RenderFlexibleBox.cpp b/Source/WebCore/rendering/RenderFlexibleBox.cpp >index 6692eac7b1130fc8e69a55e5ec9eff7a31bbd008..e65760c8d5b004923d818bc7bf15289f24052577 100644 >--- a/Source/WebCore/rendering/RenderFlexibleBox.cpp >+++ b/Source/WebCore/rendering/RenderFlexibleBox.cpp >@@ -1087,7 +1087,7 @@ LayoutUnit RenderFlexibleBox::adjustChildSizeForMinAndMax(const RenderBox& child > // https://drafts.csswg.org/css-flexbox/#intrinsic-sizes before that > // produces reasonable results. Tracking bug: https://crbug.com/581553 > // css-flexbox section 4.5 >- LayoutUnit contentSize = computeMainAxisExtentForChild(child, MinSize, Length(MinContent)).value(); >+ LayoutUnit contentSize = computeMainAxisExtentForChild(child, MinSize, Length(MinContent)).value_or(0); > ASSERT(contentSize >= 0); > if (child.hasAspectRatio() && child.intrinsicSize().height() > 0) > contentSize = adjustChildSizeForAspectRatioCrossAxisMinAndMax(child, contentSize); >@@ -1095,7 +1095,7 @@ LayoutUnit RenderFlexibleBox::adjustChildSizeForMinAndMax(const RenderBox& child > > Length mainSize = isHorizontalFlow() ? child.style().width() : child.style().height(); > if (mainAxisLengthIsDefinite(child, mainSize)) { >- LayoutUnit resolvedMainSize = computeMainAxisExtentForChild(child, MainOrPreferredSize, mainSize).value(); >+ LayoutUnit resolvedMainSize = computeMainAxisExtentForChild(child, MainOrPreferredSize, mainSize).value_or(0); > ASSERT(resolvedMainSize >= 0); > LayoutUnit specifiedSize = std::min(resolvedMainSize, maxExtent.value_or(resolvedMainSize)); > return std::max(childSize, std::min(specifiedSize, contentSize)); >diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog >index 79d6cc866e8b67a8d0396c7878af8e97a55bee0e..cd7b421275bc387e8b41eb4d401ac0c6a51a9adc 100644 >--- a/LayoutTests/ChangeLog >+++ b/LayoutTests/ChangeLog >@@ -1,3 +1,14 @@ >+2018-09-02 Zalan Bujtas <zalan@apple.com> >+ >+ REGRESSION (r191336): RenderFlexibleBox::adjustChildSizeForMinAndMax crashes in std::optional<>::value() >+ https://bugs.webkit.org/show_bug.cgi?id=189232 >+ <rdar://problem/43886373> >+ >+ Reviewed by NOBODY (OOPS!). >+ >+ * fast/flexbox/crash-when-min-max-content-is-not-computed-expected.txt: Added. >+ * fast/flexbox/crash-when-min-max-content-is-not-computed.html: Added. >+ > 2018-08-31 Zalan Bujtas <zalan@apple.com> > > [LFC] Add margin box verification back now that Display::Box has non-computed horizontal margin. >diff --git a/LayoutTests/fast/flexbox/crash-when-min-max-content-is-not-computed-expected.txt b/LayoutTests/fast/flexbox/crash-when-min-max-content-is-not-computed-expected.txt >new file mode 100644 >index 0000000000000000000000000000000000000000..73409aea8dfad393e7e27567733d29587e801218 >--- /dev/null >+++ b/LayoutTests/fast/flexbox/crash-when-min-max-content-is-not-computed-expected.txt >@@ -0,0 +1,2 @@ >+PASS if no crash. >+ >diff --git a/LayoutTests/fast/flexbox/crash-when-min-max-content-is-not-computed.html b/LayoutTests/fast/flexbox/crash-when-min-max-content-is-not-computed.html >new file mode 100644 >index 0000000000000000000000000000000000000000..82212ef3a6c532679beda0fd5a1567cce4d5ab16 >--- /dev/null >+++ b/LayoutTests/fast/flexbox/crash-when-min-max-content-is-not-computed.html >@@ -0,0 +1,22 @@ >+<!DOCTYPE html> >+<html> >+<head> >+<style> >+.outer { >+ display: flex; >+ flex-direction: column; >+} >+ >+.inner{ >+ display: grid; >+ height: 100px; >+} >+</style> >+</head> >+PASS if no crash. >+<div class=outer><div class=inner></div></div> >+<script> >+if (window.testRunner) >+ testRunner.dumpAsText(); >+</script> >+</html> >\ No newline at end of file
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Formatted Diff
|
Diff
Attachments on
bug 189232
:
348734
|
348753