[Webkit-unassigned] [Bug 112361] New: [CSS Grid Layout] computedUsedBreadthOfGridTracks doesn't fill all the grid tracks

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=112361

           Summary: [CSS Grid Layout] computedUsedBreadthOfGridTracks
                    doesn't fill all the grid tracks
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: All
        OS/Version: All
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: Layout and Rendering
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: jchaffraix at webkit.org
                CC: tony at chromium.org, xan.lopez at gmail.com,
                    ojan at chromium.org
            Blocks: 60731


The following code can be found in computedUsedBreadthOfGridTracks:

const Vector<GridTrackSize>& trackStyles = (direction == ForColumns) ? style()->gridColumns() : style()->gridRows();
[...]
Vector<GridTrack>& tracks = (direction == ForColumns) ? columnTracks : rowTracks;
for (size_t i = 0; i < trackStyles.size(); ++i) {
    GridTrack& track = tracks[i];
    const Length& minTrackBreadth = trackStyles[i].minTrackBreadth();
    const Length& maxTrackBreadth = trackStyles[i].maxTrackBreadth();
    [...]
}

While this will never read past |tracks| end, it's wrong as implicit rows / columns can make tracks.size() > trackStyles.size(). This means that implicit rows / columns are not set up properly prior to running the algorithm.

The loop should actually be:

for (size_t i = 0; i < tracks.size(); ++i) {
    GridTrack& track = tracks[i];
    const GridTrackSize& trackSize = gridTrackSize(i, direction);
    const Length& minTrackBreadth = trackSize.minTrackBreadth();
    const Length& maxTrackBreadth = trackSize.maxTrackBreadth();
    [...]

As a side note, we should investigate all the call sites iterating over the style's gridRows() / gridColumns() as they are probably wrong.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.