layout: Floor free space by 0 in solve_inline_margins_avoiding_floats() (#37362)

`PlacementAmongFloats` should guarantee that the inline size of the
placement rect is at least as big as the inline size of the box,
resulting in a non-negative free space.

However, that may fail when dealing with huge sizes that need to be
saturated to MAX_AU, so this floors the free space by zero.

Testing: New crashtest
Fixes: #37312

Signed-off-by: Oriol Brufau <obrufau@igalia.com>
This commit is contained in:
Oriol Brufau 2025-06-10 11:05:09 +02:00 committed by GitHub
parent c2ad4afcf9
commit 5c597f98e0
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 17 additions and 2 deletions

View file

@ -2023,8 +2023,10 @@ fn solve_inline_margins_avoiding_floats(
placement_rect: LogicalRect<Au>,
justify_self: AlignFlags,
) -> ((Au, Au), Au) {
let free_space = placement_rect.size.inline - inline_size;
debug_assert!(free_space >= Au::zero());
// PlacementAmongFloats should guarantee that the inline size of the placement rect
// is at least as big as `inline_size`. However, that may fail when dealing with
// huge sizes that need to be saturated to MAX_AU, so floor by zero. See #37312.
let free_space = Au::zero().max(placement_rect.size.inline - inline_size);
let cb_info = &sequential_layout_state.floats.containing_block_info;
let start_adjustment = placement_rect.start_corner.inline - cb_info.inline_start;
let end_adjustment = cb_info.inline_end - placement_rect.max_inline_position();