[markers] Fix crash with negative available-size.

Previously code in NGUnpositionedListMarker was able to produce an available_size < 0, which triggered a DCHECK in the NGBfcRect. This switches the calculation to the available-size on the container builder. Bug: 1183869 Change-Id: I61f6d95c8edbe14b71fd7577e73b287ed5e4f038 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2743418 Commit-Queue: Ian Kilpatrick <ikilpatrick@chromium.org> Auto-Submit: Ian Kilpatrick <ikilpatrick@chromium.org> Reviewed-by: Koji Ishii <kojii@chromium.org> Cr-Commit-Position: refs/heads/master@{#861025}
qweri0p · Mar 9, 2021 · 4f04551 · 4f04551
1 parent 306a9c9
commit 4f04551
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 3 deletions.
diff --git a/third_party/blink/renderer/core/layout/ng/list/ng_unpositioned_list_marker.cc b/third_party/blink/renderer/core/layout/ng/list/ng_unpositioned_list_marker.cc
@@ -161,9 +161,8 @@ LayoutUnit NGUnpositionedListMarker::ComputeIntrudedFloatOffset(
       container_builder->BfcLineOffset() +
           border_scrollbar_padding.inline_start,
       *container_builder->BfcBlockOffset() + marker_block_offset};
-  LayoutUnit available_size = container_builder->InlineSize() -
-                              border_scrollbar_padding.inline_start -
-                              border_scrollbar_padding.inline_end;
+  const LayoutUnit available_size =
+      container_builder->ChildAvailableSize().inline_size;
   NGLayoutOpportunity opportunity =
       space.ExclusionSpace().FindLayoutOpportunity(origin_offset,
                                                    available_size);

diff --git a/third_party/blink/web_tests/external/wpt/css/css-lists/list-marker-position-crash.html b/third_party/blink/web_tests/external/wpt/css/css-lists/list-marker-position-crash.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1183869">
+<div>
+  <div style="width: 1000px; display: list-item; float: right;"></div>
+  <table style="max-height: 0; display: list-item;">
+    <caption style="display: list-item;">
+      <button  style="padding-top: 6%; display: list-item;">
+        <big style="float: right;">
+          <button style="display; list-item;"></button>
+        </big>
+      </button>
+    </caption>
+  </table>
+  <h2 style="padding:0 2147483652%; max-height: 0; display: list-item;"></h2>
+</div>