Attachment 348753 Details for Bug 189232 – Patch

[patch] Patch

bug-189232-20180902200242.patch (text/plain), 4.84 KB, created by zalan on 2018-09-02 20:02:59 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: zalan

Created: 2018-09-02 20:02:59 PDT

Size: 4.84 KB

patch

obsolete

>Subversion Revision: 235589
>diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
>index fff37193dfdfd65651632ba6602b7546c4bb2018..618188fb426a90c19e078225ecf677482865068a 100644
>--- a/Source/WebCore/ChangeLog
>+++ b/Source/WebCore/ChangeLog
>@@ -1,3 +1,18 @@
>+2018-09-02  Zalan Bujtas  <zalan@apple.com>
>+
>+        REGRESSION (r191336): RenderFlexibleBox::adjustChildSizeForMinAndMax crashes in std::optional<>::value()
>+        https://bugs.webkit.org/show_bug.cgi?id=189232
>+        <rdar://problem/43886373>
>+
>+        Reviewed by Brent Fulgham.
>+
>+        It's not guaranteed that RenderFlexibleBox::computeMainAxisExtentForChild() always returns with a valid value.
>+
>+        Test: fast/flexbox/crash-when-min-max-content-is-not-computed.html
>+
>+        * rendering/RenderFlexibleBox.cpp:
>+        (WebCore::RenderFlexibleBox::adjustChildSizeForMinAndMax):
>+
> 2018-09-01  Simon Fraser  <simon.fraser@apple.com>
> 
>         Rename FilterEffectRenderer to CSSFilter
>diff --git a/Source/WebCore/rendering/RenderFlexibleBox.cpp b/Source/WebCore/rendering/RenderFlexibleBox.cpp
>index 6692eac7b1130fc8e69a55e5ec9eff7a31bbd008..2128583311d8476e28aa8255bad0256827724206 100644
>--- a/Source/WebCore/rendering/RenderFlexibleBox.cpp
>+++ b/Source/WebCore/rendering/RenderFlexibleBox.cpp
>@@ -1087,7 +1087,9 @@ LayoutUnit RenderFlexibleBox::adjustChildSizeForMinAndMax(const RenderBox& child
>         // https://drafts.csswg.org/css-flexbox/#intrinsic-sizes before that
>         // produces reasonable results. Tracking bug: https://crbug.com/581553
>         // css-flexbox section 4.5
>-        LayoutUnit contentSize = computeMainAxisExtentForChild(child, MinSize, Length(MinContent)).value();
>+        // FIXME: If the min value is expected to be valid here, we need to come up with a non optional version of computeMainAxisExtentForChild and
>+        // ensure it's valid through the virtual calls of computeIntrinsicLogicalContentHeightUsing.
>+        LayoutUnit contentSize = computeMainAxisExtentForChild(child, MinSize, Length(MinContent)).value_or(0);
>         ASSERT(contentSize >= 0);
>         if (child.hasAspectRatio() && child.intrinsicSize().height() > 0)
>             contentSize = adjustChildSizeForAspectRatioCrossAxisMinAndMax(child, contentSize);
>@@ -1095,7 +1097,7 @@ LayoutUnit RenderFlexibleBox::adjustChildSizeForMinAndMax(const RenderBox& child
>         
>         Length mainSize = isHorizontalFlow() ? child.style().width() : child.style().height();
>         if (mainAxisLengthIsDefinite(child, mainSize)) {
>-            LayoutUnit resolvedMainSize = computeMainAxisExtentForChild(child, MainOrPreferredSize, mainSize).value();
>+            LayoutUnit resolvedMainSize = computeMainAxisExtentForChild(child, MainOrPreferredSize, mainSize).value_or(0);
>             ASSERT(resolvedMainSize >= 0);
>             LayoutUnit specifiedSize = std::min(resolvedMainSize, maxExtent.value_or(resolvedMainSize));
>             return std::max(childSize, std::min(specifiedSize, contentSize));
>diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
>index 2c2f481af1fcaf10ddfe88d8f3b625d8b3b3e027..22914b3aec5d9f14e53eab7426303741d0f50055 100644
>--- a/LayoutTests/ChangeLog
>+++ b/LayoutTests/ChangeLog
>@@ -1,3 +1,14 @@
>+2018-09-02  Zalan Bujtas  <zalan@apple.com>
>+
>+        REGRESSION (r191336): RenderFlexibleBox::adjustChildSizeForMinAndMax crashes in std::optional<>::value()
>+        https://bugs.webkit.org/show_bug.cgi?id=189232
>+        <rdar://problem/43886373>
>+
>+        Reviewed by Brent Fulgham.
>+
>+        * fast/flexbox/crash-when-min-max-content-is-not-computed-expected.txt: Added.
>+        * fast/flexbox/crash-when-min-max-content-is-not-computed.html: Added.
>+
> 2018-09-02  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
> 
>         Implement Object.fromEntries
>diff --git a/LayoutTests/fast/flexbox/crash-when-min-max-content-is-not-computed-expected.txt b/LayoutTests/fast/flexbox/crash-when-min-max-content-is-not-computed-expected.txt
>new file mode 100644
>index 0000000000000000000000000000000000000000..73409aea8dfad393e7e27567733d29587e801218
>--- /dev/null
>+++ b/LayoutTests/fast/flexbox/crash-when-min-max-content-is-not-computed-expected.txt
>@@ -0,0 +1,2 @@
>+PASS if no crash.
>+
>diff --git a/LayoutTests/fast/flexbox/crash-when-min-max-content-is-not-computed.html b/LayoutTests/fast/flexbox/crash-when-min-max-content-is-not-computed.html
>new file mode 100644
>index 0000000000000000000000000000000000000000..82212ef3a6c532679beda0fd5a1567cce4d5ab16
>--- /dev/null
>+++ b/LayoutTests/fast/flexbox/crash-when-min-max-content-is-not-computed.html
>@@ -0,0 +1,22 @@
>+<!DOCTYPE html>
>+<html>
>+<head>
>+<style>
>+.outer {
>+    display: flex;
>+    flex-direction: column;
>+}
>+
>+.inner{
>+    display: grid;
>+    height: 100px;
>+}
>+</style>
>+</head>
>+PASS if no crash.
>+<div class=outer><div class=inner></div></div>
>+<script>
>+if (window.testRunner)
>+    testRunner.dumpAsText();
>+</script>
>+</html>
>\ No newline at end of file

Actions: View | Formatted Diff | Diff

Attachments on bug 189232: 348734 | 348753