[css-sizing] Ensure positive available size on replaced elements

third_party/WebKit/Source/core/layout/LayoutBox.cpp

Index: third_party/WebKit/Source/core/layout/LayoutBox.cpp
diff --git a/third_party/WebKit/Source/core/layout/LayoutBox.cpp b/third_party/WebKit/Source/core/layout/LayoutBox.cpp
index 0cda260965ad4a195be89ab2cd3e462c8d1cd65b..07968a8b6ae80dcb1c06d6584884a5560b29b59e 100644
--- a/third_party/WebKit/Source/core/layout/LayoutBox.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutBox.cpp
@@ -2839,7 +2839,7 @@ LayoutUnit LayoutBox::computeReplacedLogicalWidthUsing(SizeType sizeType, const
         // FIXME: containingBlockLogicalWidthForContent() is wrong if the replaced element's writing-mode is perpendicular to the
         // containing block's writing-mode.
         // https://bugs.webkit.org/show_bug.cgi?id=46496
-        const LayoutUnit cw = isOutOfFlowPositioned() ? containingBlockLogicalWidthForPositioned(toLayoutBoxModelObject(container())) : containingBlockLogicalWidthForContent();
+        const LayoutUnit cw = std::max(LayoutUnit(), isOutOfFlowPositioned() ? containingBlockLogicalWidthForPositioned(toLayoutBoxModelObject(container())) : containingBlockLogicalWidthForContent());

[cbiesinger, 2016/06/27 18:43:49]

So, why do these functions return a negative value? Wouldn't it be better to fix
them not to do that?

[jfernandez, 2016/06/27 21:38:43]

I though about that, actually. However, I've got lots of doubts on that
approach. First of all, these functions are quite old and widely used. Actually,
there are similar defensive logic in both, webkit and blink (look at
computeLogicalWidth function). My impression is that this logic is far for being
homogeneous; while the function
containingBlockLogicalWidthForPositioned avoids any negative value on each of
its branches, the
case of containingBlockLogicalWidthForContent is different on that regard. 

The negative values comes from the fact that width (border or content box,
depending on the box sizing, I guess)  can be less than border, padding, margin
and scrollbar. Hence, it's quite easy to define cases here the content width is
a negative value. In the case of the above mentioned function, it returns either
overrideContainingBlockContentLogicalWidth, or availableLogicalWidth
or clientLogicalWidth, all of them unprotected against negative values. 

Additionally, containingBlockLogicalWidthForContent is a virtual method, which
is defined as availableLogicalWidth, so we should protect upper classes as well
against negative values.

So I'm not sure there is an easy fix for that, considering how sensible those
functions are. 

         Length containerLogicalWidth = containingBlock()->style()->logicalWidth();
         // FIXME: Handle cases when containing block width is calculated or viewport percent.
         // https://bugs.webkit.org/show_bug.cgi?id=91071