← WebKit — 2026-W38
2eeda48d71f8ae284c198094b9387dc6ad35d1d5 [GFC] Floor grid items' content box size to zero.
severity low
class IntegerOverflow
confidence 0.38
signal score 6.1
Source/WebCore/layout
Primitive: negative grid content-box size from margins+border+padding exceeding available space
Triage note: stretchFitSize clamps availableSize - margins - borderAndPadding with std::max(0_lu, ...) so a ContentBoxSize cannot go negative. Prevents a negative/underflowed layout size in grid stretch fit; defensive and single-site, low confidence it guards an exploitable condition.
Triage note: stretchFitSize clamps availableSize - margins - borderAndPadding with std::max(0_lu, ...) so a ContentBoxSize cannot go negative. Prevents a negative/underflowed layout size in grid stretch fit; defensive and single-site, low confidence it guards an exploitable condition.
Structural signals: clamp_saturate (+1.8), msg_soft (+1.0), area:Source/WebCore/layout (+2.0), surgical (+1.3)
Commit message
[GFC] Floor grid items' content box size to zero.
https://bugs.webkit.org/show_bug.cgi?id=324377
rdar://187612019
Reviewed by Sammy Gill.
This PR fixes a bug where a stretched grid item whose padding
exceeds its grid area is sized to a negative content box.
stretchFitSize() subtracts the item's margins, border, and padding from the available space without
a floor. Adding the border and padding back cancels the negative exactly, so the item's border box
comes out as the grid area size rather than the padding sum, leaving it narrower than its own
padding.
A content box cannot be negative, so clamp it to zero. The item then stretches to a zero content
box and overflows its grid area, which is what legacy RenderGrid and Blink both produce.
* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/grid-items/grid-item-border-padding-005-expected.html: Added.
* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/grid-items/grid-item-border-padding-005-ref.html: Added.
* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/grid-items/grid-item-border-padding-005.html: Added.
* Source/WebCore/layout/formattingContexts/grid/GridLayoutUtils.cpp:
(WebCore::Layout::stretchFitSize):
Canonical link: https://commits.webkit.org/321295@main
Before / after
Loading diff…
On This Page