Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-26 22:32:46 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1931933: Use CSSMinMax instead of std::clamp in nsTextControlFrame::GetNaturalBaselineBOffset. r=layout-reviewers,emilio

Browse Source 
There is no guarantee that the block size is positive, since the size can overflow.

Differential Revision: https://phabricator.services.mozilla.com/D229678
This commit is contained in:
David Shin 2024-11-20 19:49:42 +00:00
parent 2287a05acd
commit da4c62d200
3 changed files with 15 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
layout/base/crashtests/1931933.html Normal file
View File

@ -0,0 +1,13 @@
<!DOCTYPE html>
<style>
div {
display: grid;
padding: 33554400px;
border: 5px solid;
}
textarea {
padding: 33554400px;
border: 5px solid;
}
</style>
<div class="container"><textarea></textarea></div>

1
layout/base/crashtests/crashtests.list
View File

@ -566,3 +566,4 @@ pref(layout.accessiblecaret.enabled,true) load 1819239.html
load 1821469.html
load 1849898-1.html
load 1929445.html
asserts(1-3) load 1931933.html

2
layout/forms/nsTextControlFrame.cpp
View File

@ -1243,7 +1243,7 @@ Maybe<nscoord> nsTextControlFrame::GetNaturalBaselineBOffset(
}
if (aBaselineGroup == BaselineSharingGroup::First) {
return Some(std::clamp(mFirstBaseline, 0, BSize(aWM)));
return Some(CSSMinMax(mFirstBaseline, 0, BSize(aWM)));
}
// This isn't great, but the content of the root NAC isn't guaranteed
// to be loaded, so the best we can do is the edge of the border-box.