[webkit-changes] [WebKit/WebKit] 9e694b: [IFC] Floats pushed down to LayoutUnit max may tri...

[Alan Baradlay]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 9e694b9ad56eda3d61b16f95a21fd563d3e43189
      https://github.com/WebKit/WebKit/commit/9e694b9ad56eda3d61b16f95a21fd563d3e43189
  Author: Alan Baradlay <zalan at apple.com>
  Date:   2023-04-02 (Sun, 02 Apr 2023)

  Changed paths:
    A LayoutTests/fast/inline/crash-when-floats-are-pushed-down-expected.txt
    A LayoutTests/fast/inline/crash-when-floats-are-pushed-down.html
    M Source/WebCore/layout/formattingContexts/inline/InlineFormattingGeometry.cpp

  Log Message:
  -----------
  [IFC] Floats pushed down to LayoutUnit max may trigger unexpected line state
https://bugs.webkit.org/show_bug.cgi?id=254891
<rdar://107406900>

Reviewed by Antti Koivisto.

1. When we reach LayoutUnit (max) boundary, floats start getting piled up (can't place them below LayoutUnit::max). Handle this unexpected state by not keep finding floats.
2. Due to floating point representation, we may end up with the same value after +1.f

* LayoutTests/fast/inline/crash-when-floats-are-pushed-down-expected.txt: Added.
* LayoutTests/fast/inline/crash-when-floats-are-pushed-down.html: Added.
* Source/WebCore/layout/formattingContexts/inline/InlineFormattingGeometry.cpp:
(WebCore::Layout::InlineFormattingGeometry::logicalTopForNextLine const):
(WebCore::Layout::InlineFormattingGeometry::floatConstraintsForLine const):

Canonical link: https://commits.webkit.org/262496@main