Bug 249643

Summary:	[CSS Shapes] Clamp reference box to zero for the reference box calculation in the MarginBox case
Product:	WebKit	Reporter:	Ahmad Saleem <ahmad.saleem792>
Component:	CSS	Assignee:	Nobody <webkit-unassigned>
Status:	RESOLVED WONTFIX
Severity:	Normal	CC:	noam, ntim, simon.fraser, thorton, webkit-bug-importer, zalan
Priority:	P2	Keywords:	InRadar
Version:	Safari Technology Preview
Hardware:	Unspecified
OS:	Unspecified

Description Ahmad Saleem 2022-12-20 03:59:18 PST

Hi Team,

While going through Blink's commit, I came across following:

Commit - https://src.chromium.org/viewvc/blink?view=revision&revision=192180

Webkit Source - https://searchfox.org/wubkat/source/Source/WebCore/rendering/shapes/ShapeOutsideInfo.cpp#116

If we can add clamping similar to Blink for the cases where due to negative margin on negative width/heights, we can fix assertion and crashes.

Appreciate if someone can confirm if it is worth fixing and I am happy to do PR.

Thanks!

Comment 1 Radar WebKit Bug Importer 2022-12-27 04:00:16 PST

<rdar://problem/103725054>

Comment 2 Ahmad Saleem 2023-05-06 18:38:18 PDT

This works:

void ShapeOutsideInfo::invalidateForSizeChangeIfNeeded()
{
    auto newSize = computeLogicalBoxSize(m_renderer, m_renderer.containingBlock()->isHorizontalWritingMode());
+++++    newSize.clampNegativeToZero();
    
    if (m_cachedShapeLogicalSize == newSize)
        return;

Comment 3 Ahmad Saleem 2023-09-23 18:02:40 PDT

Confirmed, we don't crash the test case from Blink commit in release and debug (thanks Tim for confirming on debug build).

Marking this as 'RESOLVED WONTFIX'.