ASSERTION FAILED: resolvedInitialPosition <= resolvedFinalPosition in WebCore::GridSp...

ASSERTION FAILED: resolvedInitialPosition <= resolvedFinalPosition in WebCore::GridSpan::GridSpan
https://bugs.webkit.org/show_bug.cgi?id=141328

Reviewed by Darin Adler.

.:

Added as manual test because it involves a huge grid allocation
which is very slow on Debug bots, the only ones capable to trigger
the assertion.

* ManualTests/css-grid-layout-item-with-huge-span-crash.html: Added.

Source/WebCore:

Whenever
GridResolvedPosition::resolveGridPositionsFromAutoPlacementPosition()
was trying to place an item with span, it was completely ignoring
the resolvedInitialPosition returned by
GridResolvedPosition::resolveGridPositionAgainstOppositePosition()
and only using the finalResolvedPosition. This works with an
unlimited grid which can indefinitely grow. But if the item spans
over the grid track limits, then it might happen that the final
resolved position is placed before the initial resolved position,
something that is forbidden.

The solution is to directly use the GridSpan returned by
GridResolvedPosition::resolveGridPositionAgainstOppositePosition(), if the item
does not surpass the track limits then the returned initialResolvedPosition
is identical to the provided one, otherwise it's properly corrected to respect
track boundaries.

* rendering/style/GridResolvedPosition.cpp:
(WebCore::GridResolvedPosition::resolveGridPositionsFromAutoPlacementPosition):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@179826 268f45cc-cd09-0410-ab3c-d52691b4dbfc