Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 17ba5b9756932d0f55821fc832ca00549275a19a
https://github.com/WebKit/WebKit/commit/17ba5b9756932d0f55821fc832ca00549275a19a
Author: Sammy Gill <[email protected]>
Date: 2026-07-26 (Sun, 26 Jul 2026)
Changed paths:
A
LayoutTests/imported/w3c/web-platform-tests/css/css-grid/layout-algorithm/flexible-column-track-intrinsic-sizing-001-crash.html
A
LayoutTests/imported/w3c/web-platform-tests/css/css-grid/layout-algorithm/flexible-column-track-intrinsic-sizing-002-crash.html
A
LayoutTests/imported/w3c/web-platform-tests/css/css-grid/layout-algorithm/flexible-column-track-intrinsic-sizing-003-crash.html
A
LayoutTests/imported/w3c/web-platform-tests/css/css-grid/layout-algorithm/flexible-column-track-intrinsic-sizing-004-crash.html
M Source/WebCore/layout/formattingContexts/grid/TrackSizingAlgorithm.cpp
Log Message:
-----------
[GFC] Crash when certain tracks get marked as inflexible
https://bugs.webkit.org/show_bug.cgi?id=320233
rdar://problem/183166106
Reviewed by Cole Carley.
During the TrackSizingAlgorithm we use a HashSet<size_t> to keep track
of whether certain tracks are classified as inflexible. However, since
the first track can get into this state, we can end up crashing when the
HashTable attempts to validate its key since the value is 0.
We can fix this simply by replacing the HashSet with a BitVector which
is probably a better match for a data structure that we want to use in
this way.
*
LayoutTests/imported/w3c/web-platform-tests/css/css-grid/layout-algorithm/flexible-column-track-intrinsic-sizing-001-crash.html:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/css/css-grid/layout-algorithm/flexible-column-track-intrinsic-sizing-002-crash.html:
Added.
These tests actually do not crash on trunk because the commit that was
causing the crashes was reverted in 317889@main but will serve as
regression tests when we want to enable GFC for the same content again.
*
LayoutTests/imported/w3c/web-platform-tests/css/css-grid/layout-algorithm/flexible-column-track-intrinsic-sizing-003-crash.html:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/css/css-grid/layout-algorithm/flexible-column-track-intrinsic-sizing-004-crash.html:
Added.
These tests, however, do actually crash without our patch so we get a
little bit of extra coverage.
Canonical link: https://commits.webkit.org/317961@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
