https://bugs.webkit.org/show_bug.cgi?id=141328
Reviewed by Darin Adler.
.:
Added as manual test because it involves a huge grid allocation
which is very slow on Debug bots, the only ones capable to trigger
the assertion.
* ManualTests/css-grid-layout-item-with-huge-span-crash.html: Added.
Source/WebCore:
Whenever
GridResolvedPosition::resolveGridPositionsFromAutoPlacementPosition()
was trying to place an item with span, it was completely ignoring
the resolvedInitialPosition returned by
GridResolvedPosition::resolveGridPositionAgainstOppositePosition()
and only using the finalResolvedPosition. This works with an
unlimited grid which can indefinitely grow. But if the item spans
over the grid track limits, then it might happen that the final
resolved position is placed before the initial resolved position,
something that is forbidden.
The solution is to directly use the GridSpan returned by
GridResolvedPosition::resolveGridPositionAgainstOppositePosition(), if the item
does not surpass the track limits then the returned initialResolvedPosition
is identical to the provided one, otherwise it's properly corrected to respect
track boundaries.
* rendering/style/GridResolvedPosition.cpp:
(WebCore::GridResolvedPosition::resolveGridPositionsFromAutoPlacementPosition):
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@179826
268f45cc-cd09-0410-ab3c-
d52691b4dbfc
+2015-02-09 Sergio Villar Senin <svillar@igalia.com>
+
+ ASSERTION FAILED: resolvedInitialPosition <= resolvedFinalPosition in WebCore::GridSpan::GridSpan
+ https://bugs.webkit.org/show_bug.cgi?id=141328
+
+ Reviewed by Darin Adler.
+
+ Added as manual test because it involves a huge grid allocation
+ which is very slow on Debug bots, the only ones capable to trigger
+ the assertion.
+
+ * ManualTests/css-grid-layout-item-with-huge-span-crash.html: Added.
+
2015-02-05 Youenn Fablet <youenn.fablet@crf.canon.fr> and Xabier Rodriguez Calvar <calvaris@igalia.com>
[Streams API] Implement a barebone ReadableStream interface
--- /dev/null
+<!DOCTYPE html>
+<p>PASSED if no crash or assertion failure.</p>
+<input/>
+<input/>
+<style>
+* {
+ display:-webkit-inline-grid;
+ -webkit-grid-row: span 400000;
+}
+</style>
+2015-02-06 Sergio Villar Senin <svillar@igalia.com>
+
+ ASSERTION FAILED: resolvedInitialPosition <= resolvedFinalPosition in WebCore::GridSpan::GridSpan
+ https://bugs.webkit.org/show_bug.cgi?id=141328
+
+ Reviewed by Darin Adler.
+
+ Whenever
+ GridResolvedPosition::resolveGridPositionsFromAutoPlacementPosition()
+ was trying to place an item with span, it was completely ignoring
+ the resolvedInitialPosition returned by
+ GridResolvedPosition::resolveGridPositionAgainstOppositePosition()
+ and only using the finalResolvedPosition. This works with an
+ unlimited grid which can indefinitely grow. But if the item spans
+ over the grid track limits, then it might happen that the final
+ resolved position is placed before the initial resolved position,
+ something that is forbidden.
+
+ The solution is to directly use the GridSpan returned by
+ GridResolvedPosition::resolveGridPositionAgainstOppositePosition(), if the item
+ does not surpass the track limits then the returned initialResolvedPosition
+ is identical to the provided one, otherwise it's properly corrected to respect
+ track boundaries.
+
+ * rendering/style/GridResolvedPosition.cpp:
+ (WebCore::GridResolvedPosition::resolveGridPositionsFromAutoPlacementPosition):
+
2015-01-22 Sergio Villar Senin <svillar@igalia.com>
[CSS Grid Layout] Tracks' growth limits must be >= base sizes
GridResolvedPosition resolvedFinalPosition = resolvedInitialPosition;
if (initialPosition.isSpan())
- resolvedFinalPosition = resolveGridPositionAgainstOppositePosition(gridContainerStyle, resolvedInitialPosition, initialPosition, finalPositionSide)->resolvedFinalPosition;
+ return *resolveGridPositionAgainstOppositePosition(gridContainerStyle, resolvedInitialPosition, initialPosition, finalPositionSide);
else if (finalPosition.isSpan())
- resolvedFinalPosition = resolveGridPositionAgainstOppositePosition(gridContainerStyle, resolvedInitialPosition, finalPosition, finalPositionSide)->resolvedFinalPosition;
+ return *resolveGridPositionAgainstOppositePosition(gridContainerStyle, resolvedInitialPosition, finalPosition, finalPositionSide);
return GridSpan(resolvedInitialPosition, resolvedFinalPosition);
}
git://git.webkit.org / WebKit-https.git / commitdiff