[webkit-changes] [WebKit/WebKit] 65e007: ASSERTION FAILED: areEssentiallyEqual(rendererMapp...

[Arunsundar Kannan]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 65e007731e39595663e9ccbbe216c21de0b6c8d8
      https://github.com/WebKit/WebKit/commit/65e007731e39595663e9ccbbe216c21de0b6c8d8
  Author: Arunsundar Kannan <arunsundar_kannan at apple.com>
  Date:   2023-04-21 (Fri, 21 Apr 2023)

  Changed paths:
    A LayoutTests/fast/layers/accumulated-offset-overflow-Render-geometry-map-expected.txt
    A LayoutTests/fast/layers/accumulated-offset-overflow-Render-geometry-map.html
    M Source/WebCore/rendering/RenderGeometryMap.cpp

  Log Message:
  -----------
  ASSERTION FAILED: areEssentiallyEqual(rendererMappedResult, result) in rendergeometrymap::mapToContainer.
https://bugs.webkit.org/show_bug.cgi?id=255686.
rdar://108285849.

Reviewed by Simon Fraser.

TransformState::translateMappedCoordinates uses accumalatedOffsets to calculate layoutsize in RenderGeometryMap.
This calcalation fails a sanity check later as the accumulated offset overflows and saturates.
Added a check to fix that.

* LayoutTests/fast/layers/accumulated-offset-overflow-Render-geometry-map-expected.txt: Added.
* LayoutTests/fast/layers/accumulated-offset-overflow-Render-geometry-map.html: Added.
* Source/WebCore/rendering/RenderGeometryMap.cpp:
(WebCore::RenderGeometryMap::mapToContainer const):

Canonical link: https://commits.webkit.org/263257@main