Bug 249643
| Summary: | [CSS Shapes] Clamp reference box to zero for the reference box calculation in the MarginBox case | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Ahmad Saleem <ahmad.saleem792> |
| Component: | CSS | Assignee: | Nobody <webkit-unassigned> |
| Status: | RESOLVED WONTFIX | ||
| Severity: | Normal | CC: | noam, ntim, simon.fraser, thorton, webkit-bug-importer, zalan |
| Priority: | P2 | Keywords: | InRadar |
| Version: | Safari Technology Preview | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
Ahmad Saleem
Hi Team,
While going through Blink's commit, I came across following:
Commit - https://src.chromium.org/viewvc/blink?view=revision&revision=192180
Webkit Source - https://searchfox.org/wubkat/source/Source/WebCore/rendering/shapes/ShapeOutsideInfo.cpp#116
If we can add clamping similar to Blink for the cases where due to negative margin on negative width/heights, we can fix assertion and crashes.
Appreciate if someone can confirm if it is worth fixing and I am happy to do PR.
Thanks!
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Radar WebKit Bug Importer
<rdar://problem/103725054>
Ahmad Saleem
This works:
void ShapeOutsideInfo::invalidateForSizeChangeIfNeeded()
{
auto newSize = computeLogicalBoxSize(m_renderer, m_renderer.containingBlock()->isHorizontalWritingMode());
+++++ newSize.clampNegativeToZero();
if (m_cachedShapeLogicalSize == newSize)
return;
Ahmad Saleem
Confirmed, we don't crash the test case from Blink commit in release and debug (thanks Tim for confirming on debug build).
Marking this as 'RESOLVED WONTFIX'.