Fix ordering issue within NGBlockLayoutAlgorithm::ComputeMinMaxSizes

The DCHECK in the bug was caused by an order-of-operations issue. Within the following calculation: max_inline_contribution = child_sizes.max_size + line_left_inset + line_right_inset; If: child_sizes.max_size == LayoutUnit::Max() line_left_inset == LayoutUnit(1) line_right_inset == LayoutUnit(-1) max_inline_contribution would be LayoutUnit::Max() - LayoutUnit(1); This resulted in max_size < min_size. Bug: 1004060 Change-Id: I3e439500f07a2cd1cf0cbe5528ece16090c9fa70 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2136885 Commit-Queue: Ian Kilpatrick <ikilpatrick@chromium.org> Reviewed-by: Morten Stenshorne <mstensho@chromium.org> Cr-Commit-Position: refs/heads/master@{#757094}

Fix ordering issue within NGBlockLayoutAlgorithm::ComputeMinMaxSizes
The DCHECK in the bug was caused by an order-of-operations issue. Within the following calculation: max_inline_contribution = child_sizes.max_size + line_left_inset + line_right_inset; If: child_sizes.max_size == LayoutUnit::Max() line_left_inset == LayoutUnit(1) line_right_inset == LayoutUnit(-1) max_inline_contribution would be LayoutUnit::Max() - LayoutUnit(1); This resulted in max_size < min_size. Bug: 1004060 Change-Id: I3e439500f07a2cd1cf0cbe5528ece16090c9fa70 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2136885 Commit-Queue: Ian Kilpatrick <ikilpatrick@chromium.org> Reviewed-by: Morten Stenshorne <mstensho@chromium.org> Cr-Commit-Position: refs/heads/master@{#757094}
f5952148 · Ian Kilpatrick · Commit Bot · 6044c2f0 · f5952148 · f5952148
Commit f5952148 authored Apr 07, 2020 by Ian Kilpatrick Committed by Commit Bot Apr 07, 2020
2 changed files
--- a/third_party/blink/renderer/core/layout/ng/ng_block_layout_algorithm.cc
+++ b/third_party/blink/renderer/core/layout/ng/ng_block_layout_algorithm.cc
@@ -309,8 +309,10 @@ base::Optional<MinMaxSizes> NGBlockLayoutAlgorithm::ComputeMinMaxSizes(
              ? std::max(float_right_inline_size, margin_line_right)
              : float_right_inline_size + margin_line_right;

+      // The order of operations is important here. If child_sizes.max_size is
+      // saturated, adding the insets sequentially can result in an DCHECK.
      max_inline_contribution =
-          child_sizes.max_size + line_left_inset + line_right_inset;
+          child_sizes.max_size + (line_left_inset + line_right_inset);
    } else {
      // This is just a standard inflow child.
      max_inline_contribution = child_sizes.max_size + margins.InlineSum();

--- a/third_party/blink/web_tests/external/wpt/css/css-sizing/min-content-negative-margin-crash.html
+++ b/third_party/blink/web_tests/external/wpt/css/css-sizing/min-content-negative-margin-crash.html
+<!quirks-mode>
+<link rel="help" href="https://crbug.com/1004060">
+<style>
+html, body {
+  width: min-content;
+  overflow: scroll;
+}
+</style>
+<body style="margin-right: -1px;">
+  <div style="margin: 0 10000000000;"></div>
+</body>