fune/testing/web-platform/tests/css/css-inline/inline-002-crash.html at 86ae9bb8ab4a840975f05aac8c1e4641e7c8bb15 - nagai/fune - Nagai Git

nagai/fune

forked from mirrors/gecko-dev

Ian Kilpatrick debeffe9cf Bug 1732073 [wpt PR 30904] - [layout] Fix metrics DCHECK., a=testonly

Automatic update from web-platform-tests
[layout] Fix metrics DCHECK.

Previously we'd hit this check quite often in clusterfuzz:
Crash Type: CHECK failure
Crash Address:
Crash State:
  !metrics_.IsEmpty() || IsEmptyLineBox() in ng_physical_line_box_fragment.cc
  blink::NGPhysicalLineBoxFragment::NGPhysicalLineBoxFragment
  scoped_refptr<blink::NGPhysicalLineBoxFragment> base::MakeRefCounted<blink::NGPh

This particular testcase is an atomic-inline with a saturated -ve margin
at the bottom.

As a result the call to BaselineMetrics within the inline layout
algorithm:
https://source.chromium.org/chromium/chromium/src/+/main:third_party/blink/renderer/core/layout/ng/inline/ng_inline_layout_algorithm.cc;l=589-593?q=baselinemetrics&ss=chromium

would result in a FontHeight of [LayoutUnit::Min(), LayoutUnit()].

This would return true for FontHeight::IsEmpty() as it only checked the
ascent.

This fixes the issue by checking the descent as will within IsEmpty().

Bug: 1243485
Change-Id: I63d9dd57a6e08dd361f21c68b60fabe025e7befc
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3173984
Commit-Queue: Koji Ishii <kojii@chromium.org>
Reviewed-by: Koji Ishii <kojii@chromium.org>
Cr-Commit-Position: refs/heads/main@{#923759}

--

wpt-commits: 30619eb589be9a693c0a4535c296826ef5fcd617
wpt-pr: 30904

2021-10-04 00:20:10 +00:00

1 line

40 B

HTML

Raw Blame History

<textarea style="margin: -1073741824;">