[CSS Grid Layout] Heap-buffer-overflow in std::sort()

r179621 added support to handle infinite sizes to the sortByGridTrackGrowthPotential() sorting function. The problem is that it broke the strict weak ordering required by std::sort when the compared items had both infinite maximum sizes, so the algorithm was going nuts. BUG=401983, 402508, 402757 Review URL: https://codereview.chromium.org/493093002 git-svn-id: svn://svn.chromium.org/blink/trunk@181634 bbb929c8-8fbe-4397-9dbb-9b2b20218538

[CSS Grid Layout] Heap-buffer-overflow in std::sort()
r179621 added support to handle infinite sizes to the sortByGridTrackGrowthPotential() sorting function. The problem is that it broke the strict weak ordering required by std::sort when the compared items had both infinite maximum sizes, so the algorithm was going nuts. BUG=401983, 402508, 402757 Review URL: https://codereview.chromium.org/493093002 git-svn-id: svn://svn.chromium.org/blink/trunk@181634 bbb929c8-8fbe-4397-9dbb-9b2b20218538
88ab925e · svillar@igalia.com · 88e3c00c · 88ab925e · 88ab925e · 88ab925e
Commit 88ab925e authored Sep 09, 2014 by svillar@igalia.com
3 changed files
--- a/third_party/WebKit/LayoutTests/fast/css-grid-layout/grid-strict-ordering-crash-2-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/css-grid-layout/grid-strict-ordering-crash-2-expected.txt
+if (window.testRunner) testRunner.dumpAsText();
+body { grid-column-end:span 200; } * { display:inline-grid; grid-column-start:foo; }
+
+This test has PASSED if it does not CRASH.
--- a/third_party/WebKit/LayoutTests/fast/css-grid-layout/grid-strict-ordering-crash-2.html
+++ b/third_party/WebKit/LayoutTests/fast/css-grid-layout/grid-strict-ordering-crash-2.html
+<!DOCTYPE html>
+<script>
+if (window.testRunner)
+    testRunner.dumpAsText();
+</script>
+<li></li>
+<style>
+body {
+    grid-column-end:span 200;
+}
+* {
+    display:inline-grid;
+    grid-column-start:foo;
+}
+</style>
+<p><br>This test has PASSED if it does not CRASH.</p>
--- a/third_party/WebKit/Source/core/rendering/RenderGrid.cpp
+++ b/third_party/WebKit/Source/core/rendering/RenderGrid.cpp
@@ -748,11 +748,13 @@ void RenderGrid::resolveContentBasedTrackSizingFunctionsForItems(GridTrackSizing

 static bool sortByGridTrackGrowthPotential(const GridTrack* track1, const GridTrack* track2)
 {
-    if (track1->m_maxBreadth == infinity)
-        return track2->m_maxBreadth == infinity;
+    // This check ensures that we respect the irreflexivity property of the strict weak ordering required by std::sort
+    // (forall x: NOT x < x).
+    if (track1->m_maxBreadth == infinity && track2->m_maxBreadth == infinity)
+        return false;

-    if (track2->m_maxBreadth == infinity)
-        return true;
+    if (track1->m_maxBreadth == infinity || track2->m_maxBreadth == infinity)
+        return track2->m_maxBreadth == infinity;

    return (track1->m_maxBreadth - track1->m_usedBreadth) < (track2->m_maxBreadth - track2->m_usedBreadth);
 }