ASSERTION FAILED: areEssentiallyEqual(rendererMappedResult, result) i…

…n rendergeometrymap::mapToContainer. https://bugs.webkit.org/show_bug.cgi?id=255686. rdar://108285849. Reviewed by Simon Fraser. TransformState::translateMappedCoordinates uses accumalatedOffsets to calculate layoutsize in RenderGeometryMap. This calcalation fails a sanity check later as the accumulated offset overflows and saturates. Added a check to fix that. * LayoutTests/fast/layers/accumulated-offset-overflow-Render-geometry-map-expected.txt: Added. * LayoutTests/fast/layers/accumulated-offset-overflow-Render-geometry-map.html: Added. * Source/WebCore/rendering/RenderGeometryMap.cpp: (WebCore::RenderGeometryMap::mapToContainer const): Canonical link: https://commits.webkit.org/263257@main
WebKit · Apr 21, 2023 · 65e0077 · 65e0077
1 parent 0819d58
commit 65e0077
Show file tree

Hide file tree

Showing 3 changed files with 42 additions and 1 deletion.
diff --git a/LayoutTests/fast/layers/accumulated-offset-overflow-Render-geometry-map-expected.txt b/LayoutTests/fast/layers/accumulated-offset-overflow-Render-geometry-map-expected.txt
@@ -0,0 +1,7 @@
+3 + 0.04705462933069371 Hello 5 8 32
+0.031199150079379234
++
+0.5793669244427325
+π
+0.5848220454729857
+
diff --git a/LayoutTests/fast/layers/accumulated-offset-overflow-Render-geometry-map.html b/LayoutTests/fast/layers/accumulated-offset-overflow-Render-geometry-map.html
@@ -0,0 +1,34 @@
+<html>
+<style>
+* { will-change: -webkit-mask;}
+.class1 { scale: 1; }
+.class9 { font: 1em/calc(18px / 0) sans-serif; -webkit-padding-start: 2px;}
+</style>
+<script>
+  if (window.testRunner) {
+    testRunner.dumpAsText();
+  }
+</script>
+<body>
+<li></li>
+<mi>3</mi>
+<mo>+</mo>
+<mn>0.04705462933069371</mn>
+<ms>Hello</ms>
+<mi>5</mi>
+<mi>8</mi>
+<munderover class="class9"></munderover>
+<mi>32</mi>
+<math>
+<mi>0.031199150079379234</mi>
+<mo>+</mo>
+<mi>0.5793669244427325</mi>
+<mtable>
+<mi>&pi;</mi>
+<mi>0.5848220454729857</mi>
+<mtr class="class1">
+<mtd style="resize: both"></mtd>
+</mtable>
+</math>
+</body>
+</html>
diff --git a/Source/WebCore/rendering/RenderGeometryMap.cpp b/Source/WebCore/rendering/RenderGeometryMap.cpp
@@ -111,7 +111,7 @@ FloatPoint RenderGeometryMap::mapToContainer(const FloatPoint& p, const RenderLa
         TransformState transformState(m_useCSS3DTransformInterop, TransformState::ApplyTransformDirection, p);
         mapToContainer(transformState, container);
         result = transformState.lastPlanarPoint();
-        ASSERT(areEssentiallyEqual(rendererMappedResult, result));
+        ASSERT(m_accumulatedOffsetMightBeSaturated ||  areEssentiallyEqual(rendererMappedResult, result));
     }
 
     return result;