tree 3634ea52c02914154a572b405029e2272d76e044
parent 17067001ecf17457b222d5e7769e1bd7a0c0b5db
author Ian Kilpatrick <ikilpatrick@chromium.org> 1632297317 -0700
committer Blink WPT Bot <blink-w3c-test-autoroller@chromium.org> 1632298207 -0700

[layout] Fix metrics DCHECK.

Previously we'd hit this check quite often in clusterfuzz:
Crash Type: CHECK failure
Crash Address:
Crash State:
  !metrics_.IsEmpty() || IsEmptyLineBox() in ng_physical_line_box_fragment.cc
  blink::NGPhysicalLineBoxFragment::NGPhysicalLineBoxFragment
  scoped_refptr<blink::NGPhysicalLineBoxFragment> base::MakeRefCounted<blink::NGPh

This particular testcase is an atomic-inline with a saturated -ve margin
at the bottom.

As a result the call to BaselineMetrics within the inline layout
algorithm:
https://source.chromium.org/chromium/chromium/src/+/main:third_party/blink/renderer/core/layout/ng/inline/ng_inline_layout_algorithm.cc;l=589-593?q=baselinemetrics&ss=chromium

would result in a FontHeight of [LayoutUnit::Min(), LayoutUnit()].

This would return true for FontHeight::IsEmpty() as it only checked the
ascent.

This fixes the issue by checking the descent as will within IsEmpty().

Bug: 1243485
Change-Id: I63d9dd57a6e08dd361f21c68b60fabe025e7befc
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3173984
Commit-Queue: Koji Ishii <kojii@chromium.org>
Reviewed-by: Koji Ishii <kojii@chromium.org>
Cr-Commit-Position: refs/heads/main@{#923759}