commit 3dc605cf2bfe3b76aabb646c24b4963922c04a21
author Andreu Botella <abotella@igalia.com> Tue Feb 13 21:18:29 2024
committer Chromium LUCI CQ <chromium-scoped@luci-project-accounts.iam.gserviceaccount.com> Tue Feb 13 21:18:29 2024
tree 8cc79f951e10a1bcfeeb0a7b8130b491eac849d2
parent b4a4916ff27b40a0f083d8e41d114567b9a82989

Fix min-content related crash in `LineBreaker::SplitTrailingBidiPreservedSpace`

In crrev.com/c/5199988, the `SplitTrailingBidiPreservedSpace` method
was added to the `LineBreaker` class, which is called right at the end
of line breaking. This method fixes a bidi bug where trailing spaces
were not being reset to the paragraph's bidi direction, and it does so
by splitting some item results (and their shape results) into two
after their construction.

This method assumes that non-empty item results always have a non-null
shape result. This is usually the case, but when computing the minimum
and maximum sizes of an inline node (e.g. for `{min,max}-content`), a
fast path is used (`LineBreak::HandleTextForFastMinContent`) which
creates inline item results with a null shape result. This caused a
crash when trying to create a `ShapeResultView` without a source shape
result.

This patch fixes this by adding an early return from
`LineBreaker::SplitTrailingBidiPreservedSpace` if the line breaker
mode is `kMinContent`. This is incorrect, but it can only affect the
hanging behavior of trailing other space separators, which is already
incorrect with `{min,max}-content` even in non-bidi text. We are
already working on fixing this behavior, and we don't expect any
breakage resulting from this early return.

Bug: 324684931
Change-Id: I6a5a7aae06a0aafdb34b5836030921041d50dfb3
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5291239
Reviewed-by: Koji Ishii <kojii@chromium.org>
Commit-Queue: Andreu Botella <abotella@igalia.com>
Cr-Commit-Position: refs/heads/main@{#1260059}