[css-grid] Protect against negative values in applyStretchAlignmentToChildIfNeeded()

third_party/WebKit/Source/core/layout/LayoutGrid.cpp

Index: third_party/WebKit/Source/core/layout/LayoutGrid.cpp
diff --git a/third_party/WebKit/Source/core/layout/LayoutGrid.cpp b/third_party/WebKit/Source/core/layout/LayoutGrid.cpp
index 554dd56f02e6a7f27964a87cb991eb8c92460a91..1af3ef0cc2abebdea641437c068258cf3c58a09c 100644
--- a/third_party/WebKit/Source/core/layout/LayoutGrid.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutGrid.cpp
@@ -1473,7 +1473,8 @@ void LayoutGrid::applyStretchAlignmentToChildIfNeeded(LayoutBox& child) {
     LayoutUnit desiredLogicalHeight = child.constrainLogicalHeightByMinMax(
         stretchedLogicalHeight, LayoutUnit(-1));
     child.setOverrideLogicalContentHeight(
-        desiredLogicalHeight - child.borderAndPaddingLogicalHeight());
+        std::max(desiredLogicalHeight - child.borderAndPaddingLogicalHeight(),
+                 LayoutUnit()));

[svillar, 2017/03/09 10:29:15]

clampNegativeToZero()

[Manuel Rego, 2017/03/09 10:59:13]

Done.

     if (desiredLogicalHeight != child.logicalHeight()) {
       // TODO (lajava): Can avoid laying out here in some cases. See
       // https://webkit.org/b/87905.