[webkit-changes] [WebKit/WebKit] 7fd475: REGRESSION(283008 at main): spotify.com crashes when ...

[Antti Koivisto]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 7fd47546fe44be81e0ce2fd1c9705335abc39858
      https://github.com/WebKit/WebKit/commit/7fd47546fe44be81e0ce2fd1c9705335abc39858
  Author: Antti Koivisto <antti at apple.com>
  Date:   2024-10-02 (Wed, 02 Oct 2024)

  Changed paths:
    A LayoutTests/fast/css/grid-span-calc-negative-crash-expected.txt
    A LayoutTests/fast/css/grid-span-calc-negative-crash.html
    M Source/WebCore/style/StyleBuilderConverter.h

  Log Message:
  -----------
  REGRESSION(283008 at main): spotify.com crashes when loading an artist
https://bugs.webkit.org/show_bug.cgi?id=280793
rdar://136786673

Reviewed by Alan Baradlay.

After 283008 at main we evaluate integer calc() late. This allowed an illegal negative value
through with

grid-column-start: span calc(-1)

that grid layout code couldn't handle.

* LayoutTests/fast/css/grid-span-calc-negative-crash-expected.txt: Added.
* LayoutTests/fast/css/grid-span-calc-negative-crash.html: Added.
* Source/WebCore/style/StyleBuilderConverter.h:
(WebCore::Style::BuilderConverter::createGridPosition):

Don't allow negative values with span.

Canonical link: https://commits.webkit.org/284592@main



To unsubscribe from these emails, change your notification settings at https://github.com/WebKit/WebKit/settings/notifications