Remaining page height should never be 0

https://bugs.webkit.org/show_bug.cgi?id=257087 rdar://problem/109929893 Reviewed by Alan Baradlay. Partial Merge: https://chromium.googlesource.com/chromium/src.git/+/3e04625f97ad0ae12a02e5f4b4d1e40973d01d29 & https://chromium.googlesource.com/chromium/src.git/+/2fa8cb1b82fe741f526a5009f17b03158349e681 This patch covers the case where if 'LayoutUnit' reaches infinity, it just uses 'pageLogicalHeight' as 'remainingHeight'. * Source/WebCore/rendering/RenderFragmentedFlow.cpp: (RenderFragmentedFlow::pageRemainingLogicalHeightForOffset): Add 'else if' case * LayoutTests/fast/multicol/zero-height-inner-multicol-at-boundary-crash.html: Add Test Case * LayoutTests/fast/multicol/zero-height-inner-multicol-at-boundary-crash-expected.txt: Add Test Case Expectation * LayoutTests/fast/multicol/infinitely-tall-content-in-outer-crash.html: Add Test Case * LayoutTests/fast/multicol/infinitely-tall-content-in-outer-crash-expected.txt: Add Test Case Expectation Canonical link: https://commits.webkit.org/264857@main
WebKit · Jun 5, 2023 · d0421ad · d0421ad
1 parent 1e30f54
commit d0421ad
Show file tree

Hide file tree

Showing 5 changed files with 40 additions and 0 deletions.
diff --git a/LayoutTests/fast/multicol/infinitely-tall-content-in-outer-crash-expected.txt b/LayoutTests/fast/multicol/infinitely-tall-content-in-outer-crash-expected.txt
@@ -0,0 +1,4 @@
+PASS if no crash or assertion failure.
+
+
+
diff --git a/LayoutTests/fast/multicol/infinitely-tall-content-in-outer-crash.html b/LayoutTests/fast/multicol/infinitely-tall-content-in-outer-crash.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<script>
+    if (window.testRunner)
+        testRunner.dumpAsText();
+</script>
+<p>PASS if no crash or assertion failure.</p>
+<div style="-webkit-columns:3; column-fill:auto; height:600px;">
+    <div style="height:12345678987654321px;"></div>
+    <div style="-webkit-columns:3;">
+        <div style="height:10000px;"></div>
+        <br>
+    </div>
+</div>
diff --git a/LayoutTests/fast/multicol/zero-height-inner-multicol-at-boundary-crash-expected.txt b/LayoutTests/fast/multicol/zero-height-inner-multicol-at-boundary-crash-expected.txt
@@ -0,0 +1,3 @@
+
+PASS No crash or assertion failure.
+
diff --git a/LayoutTests/fast/multicol/zero-height-inner-multicol-at-boundary-crash.html b/LayoutTests/fast/multicol/zero-height-inner-multicol-at-boundary-crash.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<div style="columns:2; column-fill:auto; height:20px;">
+    <div style="columns:2;">
+        <div style="height:40px;"></div>
+        <div style="columns:1; height:0; column-fill:auto;">
+            <div></div>
+        </div>
+    </div>
+</div>
+<script src="../../resources/testharness.js"></script>
+<script src="../../resources/testharnessreport.js"></script>
+<script>
+    test(() => { }, "No crash or assertion failure.");
+</script>
diff --git a/Source/WebCore/rendering/RenderFragmentedFlow.cpp b/Source/WebCore/rendering/RenderFragmentedFlow.cpp
@@ -420,6 +420,12 @@ LayoutUnit RenderFragmentedFlow::pageRemainingLogicalHeightForOffset(LayoutUnit
         // If IncludePageBoundary is set, the line exactly on the top edge of a
         // fragment will act as being part of the previous fragment.
         remainingHeight = intMod(remainingHeight, pageLogicalHeight);
+    } else if (!remainingHeight) {
+        // When pageBoundaryRule is IncludePageBoundary, we shouldn't just return 0 if there's no
+        // space left, because in that case we're at a column boundary, in which case we should
+        // return the amount of space remaining in the *next* column. Note that the page height
+        // itself may be 0, though.
+        remainingHeight = pageLogicalHeight;
     }
     return remainingHeight;
 }