Diff
Modified: trunk/LayoutTests/ChangeLog (255412 => 255413)
--- trunk/LayoutTests/ChangeLog 2020-01-30 03:27:41 UTC (rev 255412)
+++ trunk/LayoutTests/ChangeLog 2020-01-30 04:12:57 UTC (rev 255413)
@@ -1,3 +1,14 @@
+2020-01-29 Sunny He <sunny...@apple.com>
+
+ Clamp paddingBoxWidth/Height to a minimum of zero
+ https://bugs.webkit.org/show_bug.cgi?id=206317
+ rdar://57102010
+
+ Reviewed by Zalan Bujtas.
+
+ * fast/multicol/crash-negative-paddingBoxWidth-expected.txt: Added.
+ * fast/multicol/crash-negative-paddingBoxWidth.html: Added.
+
2020-01-29 Justin Fan <justin_...@apple.com>
[WebGL] Skip ANGLE-dependent WebGL 2 expected progressions on WebGL bot
Added: trunk/LayoutTests/fast/multicol/crash-negative-paddingBoxWidth-expected.txt (0 => 255413)
--- trunk/LayoutTests/fast/multicol/crash-negative-paddingBoxWidth-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/multicol/crash-negative-paddingBoxWidth-expected.txt 2020-01-30 04:12:57 UTC (rev 255413)
@@ -0,0 +1,4 @@
+
+Check that interactions between column gap, width, and scrollbar width don't cause crashes.
+
+PASS
Added: trunk/LayoutTests/fast/multicol/crash-negative-paddingBoxWidth.html (0 => 255413)
--- trunk/LayoutTests/fast/multicol/crash-negative-paddingBoxWidth.html (rev 0)
+++ trunk/LayoutTests/fast/multicol/crash-negative-paddingBoxWidth.html 2020-01-30 04:12:57 UTC (rev 255413)
@@ -0,0 +1,14 @@
+<html>
+ <style>
+ * { width: 25%; grid-gap: 40%; columns: 6px;}
+ </style>
+ <script>
+ if (window.testRunner)
+ testRunner.dumpAsText();
+ </script>
+ <body>
+ <textarea>A</textarea>
+ <p>Check that interactions between column gap, width, and scrollbar width don't cause crashes.</p>
+ PASS
+ </body>
+</html>
\ No newline at end of file
Modified: trunk/LayoutTests/imported/w3c/ChangeLog (255412 => 255413)
--- trunk/LayoutTests/imported/w3c/ChangeLog 2020-01-30 03:27:41 UTC (rev 255412)
+++ trunk/LayoutTests/imported/w3c/ChangeLog 2020-01-30 04:12:57 UTC (rev 255413)
@@ -1,3 +1,26 @@
+2020-01-29 Sunny He <sunny...@apple.com>
+
+ Clamp paddingBoxWidth/Height to a minimum of zero
+ https://bugs.webkit.org/show_bug.cgi?id=206317
+ rdar://57102010
+
+ Reviewed by Zalan Bujtas.
+
+ Source/WebCore:
+
+ Test: fast/multicol/crash-negative-paddingBoxWidth.html
+
+ * rendering/RenderBox.h:
+ (WebCore::RenderBox::paddingBoxWidth const):
+ (WebCore::RenderBox::paddingBoxHeight const):
+
+ LayoutTests:
+
+ * fast/multicol/crash-negative-paddingBoxWidth-expected.txt: Added.
+ * fast/multicol/crash-negative-paddingBoxWidth.html: Added.
+
+ * web-platform-tests/css/cssom-view/scrollLeft-of-scroller-with-wider-scrollbar-expected.txt:
+
2020-01-29 Carlos Alberto Lopez Perez <clo...@igalia.com>
Update WPT tests for css-easing (previously known as css-timing)
Modified: trunk/LayoutTests/imported/w3c/web-platform-tests/css/cssom-view/scrollLeft-of-scroller-with-wider-scrollbar-expected.txt (255412 => 255413)
--- trunk/LayoutTests/imported/w3c/web-platform-tests/css/cssom-view/scrollLeft-of-scroller-with-wider-scrollbar-expected.txt 2020-01-30 03:27:41 UTC (rev 255412)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/css/cssom-view/scrollLeft-of-scroller-with-wider-scrollbar-expected.txt 2020-01-30 04:12:57 UTC (rev 255413)
@@ -1,3 +1,3 @@
-FAIL Test the maxmium value of scrollLeft assert_equals: expected 100 but got 110
+PASS Test the maxmium value of scrollLeft
Modified: trunk/Source/WebCore/ChangeLog (255412 => 255413)
--- trunk/Source/WebCore/ChangeLog 2020-01-30 03:27:41 UTC (rev 255412)
+++ trunk/Source/WebCore/ChangeLog 2020-01-30 04:12:57 UTC (rev 255413)
@@ -1,3 +1,17 @@
+2020-01-29 Sunny He <sunny...@apple.com>
+
+ Clamp paddingBoxWidth/Height to a minimum of zero
+ https://bugs.webkit.org/show_bug.cgi?id=206317
+ rdar://57102010
+
+ Reviewed by Zalan Bujtas.
+
+ Test: fast/multicol/crash-negative-paddingBoxWidth.html
+
+ * rendering/RenderBox.h:
+ (WebCore::RenderBox::paddingBoxWidth const):
+ (WebCore::RenderBox::paddingBoxHeight const):
+
2020-01-29 Robin Morisset <rmoris...@apple.com>
Remove Options::enableSpectreMitigations
Modified: trunk/Source/WebCore/rendering/RenderBox.h (255412 => 255413)
--- trunk/Source/WebCore/rendering/RenderBox.h 2020-01-30 03:27:41 UTC (rev 255412)
+++ trunk/Source/WebCore/rendering/RenderBox.h 2020-01-30 04:12:57 UTC (rev 255413)
@@ -217,8 +217,8 @@
LayoutUnit contentLogicalWidth() const { return style().isHorizontalWritingMode() ? contentWidth() : contentHeight(); }
LayoutUnit contentLogicalHeight() const { return style().isHorizontalWritingMode() ? contentHeight() : contentWidth(); }
- LayoutUnit paddingBoxWidth() const { return width() - borderLeft() - borderRight() - verticalScrollbarWidth(); }
- LayoutUnit paddingBoxHeight() const { return height() - borderTop() - borderBottom() - horizontalScrollbarHeight(); }
+ LayoutUnit paddingBoxWidth() const { return std::max(0_lu, width() - borderLeft() - borderRight() - verticalScrollbarWidth()); }
+ LayoutUnit paddingBoxHeight() const { return std::max(0_lu, height() - borderTop() - borderBottom() - horizontalScrollbarHeight()); }
LayoutRect paddingBoxRect() const;
LayoutRect paddingBoxRectIncludingScrollbar() const { return LayoutRect(borderLeft(), borderTop(), width() - borderLeft() - borderRight(), height() - borderTop() - borderBottom()); }
Modified: trunk/Source/WebCore/rendering/RenderReplaced.cpp (255412 => 255413)
--- trunk/Source/WebCore/rendering/RenderReplaced.cpp 2020-01-30 03:27:41 UTC (rev 255412)
+++ trunk/Source/WebCore/rendering/RenderReplaced.cpp 2020-01-30 04:12:57 UTC (rev 255413)
@@ -479,8 +479,10 @@
// This solves above equation for 'width' (== logicalWidth).
LayoutUnit marginStart = minimumValueForLength(style().marginStart(), logicalWidth);
- LayoutUnit marginEnd = minimumValueForLength(style().marginEnd(), logicalWidth);
- logicalWidth = std::max(0_lu, (logicalWidth - (marginStart + marginEnd + (size().width() - clientWidth()))));
+ LayoutUnit marginEnd = minimumValueForLength(style().marginEnd(), logicalWidth);
+
+ // FIXME: This _expression_ does not align with the comment above, which is quoting https://www.w3.org/TR/CSS22/visudet.html#blockwidth.
+ logicalWidth = std::max(0_lu, (logicalWidth - (marginStart + marginEnd + borderLeft() + borderRight())));
return computeReplacedLogicalWidthRespectingMinMaxWidth(logicalWidth, shouldComputePreferred);
}
