[css-flex] Fix LayoutUnit overflow in automatic minimum size calculation

davidsgrogan · chromium-wpt-export-bot · commit 8fe6ed48ed74 · 2020-11-30T20:25:06.000-08:00
When using the aspect ratio, we were doing size = large1 * large2 / large3. large1 * large2 was overflowing LayoutUnit. Now we do those calculations with the operands as doubles. We still multiply first because *most* of the time these values will all be integers, and all the integers up to LayoutUnit::Max()*LayoutUnit::Max() can be exactly represented with double precision. Change-Id: Id714f38493554c5f1b7e4dfe56bdaa6742f3d8a5 Fixed: 1151608 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2564199 Commit-Queue: David Grogan <dgrogan@chromium.org> Reviewed-by: Ian Kilpatrick <ikilpatrick@chromium.org> Cr-Commit-Position: refs/heads/master@{#832193}
diff --git a/css/css-flexbox/flex-minimum-size-003.html b/css/css-flexbox/flex-minimum-size-003.html
@@ -0,0 +1,23 @@
+<!doctype html>
+<link rel="author" title="David Grogan" href="mailto:dgrogan@chromium.org">
+<link rel="help" href="https://drafts.csswg.org/css-flexbox/#min-size-auto">
+<link rel="help" href="https://crbug.com/1151608">
+<meta name="assert" content="automatic minimum size computation doesn't overflow when multiplying by the aspect ratio" />
+
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/resources/check-layout-th.js"></script>
+
+<body onload="checkLayout('img')">
+
+<div id=log></div>
+
+<div style="display: flex; width: 300px;">
+  <img src="data:image/svg+xml,%3Csvg viewBox='0 0 1 1' width='8000' height='8000' xmlns='http://www.w3.org/2000/svg' %3E%3C/svg%3E" data-expected-width=8000 style="height: 8000px;">
+</div>
+
+<div style="display: flex; flex-direction: column; height: 300px;">
+  <img src="data:image/svg+xml,%3Csvg viewBox='0 0 1 1' width='8000' height='8000' xmlns='http://www.w3.org/2000/svg' %3E%3C/svg%3E" data-expected-height=8000 style="width: 8000px;">
+</div>
+
+</body>
