FrameSet: Fix an issue by a large relative value in rows/cols attribute
In LayOutAxis(), handling of large relative values were inconsistent:
- ClampTo<int> is applied in total_relative computation.
- ClampTo<int> is not applied in grid_layout[i] computation.
It could produce sizes greater than |available_len| and negative sizes.
Bug: 1353277
Change-Id: I3a992ffe05ac9f892182124c934f0df8af34fa50
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3832987
Reviewed-by: Morten Stenshorne <mstensho@chromium.org>
Commit-Queue: Kent Tamura <tkent@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1035755}
diff --git a/html/rendering/non-replaced-elements/the-frameset-and-frame-elements/large-cols-relsize.html b/html/rendering/non-replaced-elements/the-frameset-and-frame-elements/large-cols-relsize.html
index 1bfb2b5..16cf9a4 100644
--- a/html/rendering/non-replaced-elements/the-frameset-and-frame-elements/large-cols-relsize.html
+++ b/html/rendering/non-replaced-elements/the-frameset-and-frame-elements/large-cols-relsize.html
@@ -1,8 +1,21 @@
<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
<link rel="help" href="https://html.spec.whatwg.org/multipage/rendering.html#frames-and-framesets">
<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1116832">
-<link rel="match" href="reference/green-ref.html">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1353277">
+<script>
+window.onload = () => {
+ test(() => {
+ const frameSet = document.querySelector('frameset');
+ const frames = document.querySelectorAll('frame');
+ assert_less_than(frames[0].offsetWidth, frameSet.offsetWidth);
+ assert_greater_than_equal(frames[0].offsetWidth, 0);
+ assert_greater_than_equal(frames[1].offsetWidth, 0);
+ }, 'A large relative value should not produce weird sizes.');
+};
+</script>
<frameset cols="4294967227*,*" frameborder="0">
<frame src="resources/green.html">
<frame src="resources/red.html">
diff --git a/html/rendering/non-replaced-elements/the-frameset-and-frame-elements/large-rows-relsize.html b/html/rendering/non-replaced-elements/the-frameset-and-frame-elements/large-rows-relsize.html
index 7fd29f6..24f34f5 100644
--- a/html/rendering/non-replaced-elements/the-frameset-and-frame-elements/large-rows-relsize.html
+++ b/html/rendering/non-replaced-elements/the-frameset-and-frame-elements/large-rows-relsize.html
@@ -1,8 +1,21 @@
<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
<link rel="help" href="https://html.spec.whatwg.org/multipage/rendering.html#frames-and-framesets">
<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1116832">
-<link rel="match" href="reference/green-ref.html">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1353277">
+<script>
+window.onload = () => {
+ test(() => {
+ const frameSet = document.querySelector('frameset');
+ const frames = document.querySelectorAll('frame');
+ assert_less_than(frames[0].offsetHeight, frameSet.offsetHeight);
+ assert_greater_than_equal(frames[0].offsetHeight, 0);
+ assert_greater_than_equal(frames[1].offsetHeight, 0);
+ }, 'A large relative value should not produce weird sizes.');
+};
+</script>
<frameset rows="4294967227*,*" frameborder="0">
<frame src="resources/green.html">
<frame src="resources/red.html">
