[CSS Grid Layout] Heap-buffer-overflow in std::sort()

[CSS Grid Layout] Heap-buffer-overflow in std::sort()

r179621 added support to handle infinite sizes to the
sortByGridTrackGrowthPotential() sorting function. The problem is that it broke
the strict weak ordering required by std::sort when the compared items had both
infinite maximum sizes, so the algorithm was going nuts.

BUG=401983, 402508, 402757
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=181634

[svillar, 2014-08-21 14:01:52]

Sending for review. Amazingly we had the same issue in that same function back
in WebKit times (see r141810) :)

[cbiesinger, 2014-08-21 20:48:00]

lgtm

[svillar, 2014-08-22 07:25:10]

The CQ bit was checked by svillar@igalia.com

[commit-bot: I haz the power, 2014-08-22 07:26:15]

CQ is trying da patch. Follow status at
 https://chromium-status.appspot.com/cq/svillar@igalia.com/493093002/1

[commit-bot: I haz the power, 2014-08-22 08:23:15]

FYI, CQ is re-trying this CL (attempt #1).
The failing builders are:
  android_chromium_gn_compile_rel on tryserver.blink
(http://build.chromium.org/p/tryserver.blink/builders/android_chromium_gn_comp...)
  blink_presubmit on tryserver.blink
(http://build.chromium.org/p/tryserver.blink/builders/blink_presubmit/builds/1...)
  mac_blink_compile_dbg on tryserver.blink
(http://build.chromium.org/p/tryserver.blink/builders/mac_blink_compile_dbg/bu...)

[commit-bot: I haz the power, 2014-08-22 08:25:23]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2014-08-22 08:25:24]

Try jobs failed on following builders:
  blink_presubmit on tryserver.blink
(http://build.chromium.org/p/tryserver.blink/builders/blink_presubmit/builds/1...)

[svillar, 2014-08-22 14:03:13]

On 2014/08/22 08:25:24, I haz the power (commit-bot) wrote:
> Try jobs failed on following builders:
>   blink_presubmit on tryserver.blink
>
(http://build.chromium.org/p/tryserver.blink/builders/blink_presubmit/builds/1...)

Oh I thought you're OWNER

[cbiesinger, 2014-08-22 20:53:46]

On 2014/08/22 14:03:13, svillar wrote:
> On 2014/08/22 08:25:24, I haz the power (commit-bot) wrote:
> > Try jobs failed on following builders:
> >   blink_presubmit on tryserver.blink
> >
>
(http://build.chromium.org/p/tryserver.blink/builders/blink_presubmit/builds/1...)
> 
> Oh I thought you're OWNER

Ah sorry... not yet :)

[svillar, 2014-08-26 09:11:52]

@jchaffraix, @esprehn: anyone?

[Julien - ping for review, 2014-09-08 21:10:14]

Another weak ordering fun bug /o\

LGTM

https://codereview.chromium.org/493093002/diff/1/Source/core/rendering/Render...
File Source/core/rendering/RenderGrid.cpp (right):

https://codereview.chromium.org/493093002/diff/1/Source/core/rendering/Render...
Source/core/rendering/RenderGrid.cpp:745: if (track1->m_maxBreadth == infinity
&& track2->m_maxBreadth == infinity)
We should probably add a comment about how this makes us very the irreflexivity
property of the weak ordering (x < x is false for all x).

[svillar, 2014-09-09 10:23:30]

The CQ bit was checked by svillar@igalia.com

[commit-bot: I haz the power, 2014-09-09 10:23:57]

CQ is trying da patch. Follow status at
 https://chromium-status.appspot.com/cq/svillar@igalia.com/493093002/20001

[commit-bot: I haz the power, 2014-09-09 11:26:18]

Committed patchset #2 (id:20001) as 181634