Skip to content


Browse files Browse the repository at this point in the history
Remaining page height should never be 0

Reviewed by Alan Baradlay.

Partial Merge: &

This patch covers the case where if 'LayoutUnit' reaches infinity, it just uses 'pageLogicalHeight' as 'remainingHeight'.

* Source/WebCore/rendering/RenderFragmentedFlow.cpp:
(RenderFragmentedFlow::pageRemainingLogicalHeightForOffset): Add 'else if' case
* LayoutTests/fast/multicol/zero-height-inner-multicol-at-boundary-crash.html: Add Test Case
* LayoutTests/fast/multicol/zero-height-inner-multicol-at-boundary-crash-expected.txt: Add Test Case Expectation
* LayoutTests/fast/multicol/infinitely-tall-content-in-outer-crash.html: Add Test Case
* LayoutTests/fast/multicol/infinitely-tall-content-in-outer-crash-expected.txt: Add Test Case Expectation

Canonical link:
  • Loading branch information
Ahmad-S792 authored and Ahmad Saleem committed Jun 5, 2023
1 parent 1e30f54 commit d0421ad
Show file tree
Hide file tree
Showing 5 changed files with 40 additions and 0 deletions.
@@ -0,0 +1,4 @@
PASS if no crash or assertion failure.

@@ -0,0 +1,13 @@
<!DOCTYPE html>
if (window.testRunner)
<p>PASS if no crash or assertion failure.</p>
<div style="-webkit-columns:3; column-fill:auto; height:600px;">
<div style="height:12345678987654321px;"></div>
<div style="-webkit-columns:3;">
<div style="height:10000px;"></div>
@@ -0,0 +1,3 @@

PASS No crash or assertion failure.

@@ -0,0 +1,14 @@
<!DOCTYPE html>
<div style="columns:2; column-fill:auto; height:20px;">
<div style="columns:2;">
<div style="height:40px;"></div>
<div style="columns:1; height:0; column-fill:auto;">
<script src="../../resources/testharness.js"></script>
<script src="../../resources/testharnessreport.js"></script>
test(() => { }, "No crash or assertion failure.");
6 changes: 6 additions & 0 deletions Source/WebCore/rendering/RenderFragmentedFlow.cpp
Expand Up @@ -420,6 +420,12 @@ LayoutUnit RenderFragmentedFlow::pageRemainingLogicalHeightForOffset(LayoutUnit
// If IncludePageBoundary is set, the line exactly on the top edge of a
// fragment will act as being part of the previous fragment.
remainingHeight = intMod(remainingHeight, pageLogicalHeight);
} else if (!remainingHeight) {
// When pageBoundaryRule is IncludePageBoundary, we shouldn't just return 0 if there's no
// space left, because in that case we're at a column boundary, in which case we should
// return the amount of space remaining in the *next* column. Note that the page height
// itself may be 0, though.
remainingHeight = pageLogicalHeight;
return remainingHeight;
Expand Down

0 comments on commit d0421ad

Please sign in to comment.