Bug 1225005 - Clamp negative values in containing block size. r=roc
authorMats Palmgren <mats@mozilla.com>
Wed, 02 Mar 2016 23:39:34 +0100
changeset 324779 7c7fe4da388c108de2867a695d472f5cbab3c2a1
parent 324778 9060d17ed51093ffe5ae5fe1b842e8a72a7c59a2
child 324780 65554e19955c8a610addf7d05e7fa889e53246ca
push id1128
push userjlund@mozilla.com
push dateWed, 01 Jun 2016 01:31:59 +0000
treeherdermozilla-release@fe0d30de989d [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersroc
bugs1225005
milestone47.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1225005 - Clamp negative values in containing block size. r=roc
layout/generic/crashtests/1225005.html
layout/generic/crashtests/crashtests.list
layout/generic/nsFrame.cpp
new file mode 100644
--- /dev/null
+++ b/layout/generic/crashtests/1225005.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<html>
+<body style="padding: 810520769306363pt; -moz-column-count: 10; transform: translate(50%);"><div style="position: absolute;"></div></body>
+</html>
--- a/layout/generic/crashtests/crashtests.list
+++ b/layout/generic/crashtests/crashtests.list
@@ -613,8 +613,9 @@ load outline-on-frameset.xhtml
 pref(dom.details_element.enabled,true) load summary-position-out-of-flow.html
 load text-overflow-bug666751-1.html
 load text-overflow-bug666751-2.html
 load text-overflow-bug670564.xhtml
 load text-overflow-bug671796.xhtml
 load text-overflow-bug713610.html
 load text-overflow-form-elements.html
 load text-overflow-iframe.html
+asserts(4) load 1225005.html # bug 682647 and bug 448083
--- a/layout/generic/nsFrame.cpp
+++ b/layout/generic/nsFrame.cpp
@@ -4624,22 +4624,19 @@ nsFrame::ReflowAbsoluteFrames(nsPresCont
     nsAbsoluteContainingBlock* absoluteContainer = GetAbsoluteContainingBlock();
 
     // Let the absolutely positioned container reflow any absolutely positioned
     // child frames that need to be reflowed
 
     // The containing block for the abs pos kids is formed by our padding edge.
     nsMargin usedBorder = GetUsedBorder();
     nscoord containingBlockWidth =
-      aDesiredSize.Width() - usedBorder.LeftRight();
-    MOZ_ASSERT(containingBlockWidth >= 0);
+      std::max(0, aDesiredSize.Width() - usedBorder.LeftRight());
     nscoord containingBlockHeight =
-      aDesiredSize.Height() - usedBorder.TopBottom();
-    MOZ_ASSERT(containingBlockHeight >= 0);
-
+      std::max(0, aDesiredSize.Height() - usedBorder.TopBottom());
     nsContainerFrame* container = do_QueryFrame(this);
     NS_ASSERTION(container, "Abs-pos children only supported on container frames for now");
 
     nsRect containingBlock(0, 0, containingBlockWidth, containingBlockHeight);
     AbsPosReflowFlags flags =
       AbsPosReflowFlags::eCBWidthAndHeightChanged; // XXX could be optimized
     if (aConstrainBSize) {
       flags |= AbsPosReflowFlags::eConstrainHeight;