1518433 - Very high CSS <length> values may be misinterpreted due to NS_{UNCONSTRAINEDSIZE,INTRINSICSIZE,AUTOHEIGHT,AUTOOFFSET} being equal to nscoord_MAX

Status: NEW

(Core :: Layout, defect, P3)

Description

[Andy Earnshaw]

Attachment: css-length-clamp.html

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36

Steps to reproduce:

1. Create web page containing a solitary div with a height unsupported by Firefox (max is about 17187496px, but if you want to compare other browsers then you might want to double this value).
2. Open the dev tools/element inspector and inspect the div
3. Check both the computed height and offsetHeight

Actual results:

The element has a computed height of 0px

Expected results:

According to the spec,

In cases where the used length cannot be supported, user agents must approximate it in the actual value.

0 is not an approximation of whatever very large number you enter. Both Chrome and Safari clamp the height to the maximum permitted value. Not sure on IE/Edge's behaviour.

Comment 1

[Andy Earnshaw]

I checked Edge in SauceLabs, it clamps like Safari and Chrome.

Comment 2

[Cristian Craciun]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:66.0) Gecko/20100101 Firefox/66.0
Build ID: 20190114014511

I managed to reproduce this issue on macOS 10.13.6 with the latest Firefox Nightly version 66.0a1.

Comment 3

[Emilio Cobos Álvarez (:emilio)]

I took a quick look, we're not clamping to zero, the style system properly propagates the number and layout clamps it.

We're treating the height as auto instead (you can see this easily if you add some text to the <div>). This is because we're using the maximum value as auto height:

https://searchfox.org/mozilla-central/rev/8ff2cd0a27e3764d9540abdc5a66b2fb1e4e9644/layout/base/LayoutConstants.h#22

Comment 4

[Emilio Cobos Álvarez (:emilio)]

I'd note that margins use a different constant just to get around this problem:

https://searchfox.org/mozilla-central/rev/8ff2cd0a27e3764d9540abdc5a66b2fb1e4e9644/layout/base/LayoutConstants.h#26

So not sure whether this behavior is intentional or not.

Comment 5

[Emilio Cobos Álvarez (:emilio)]

Let's see what try thinks of this: https://treeherder.mozilla.org/#/jobs?repo=try&revision=5ee936775018f0de14187b4c33fbd6b2470b7f35

Comment 6

[Emilio Cobos Álvarez (:emilio)]

Well that clearly needs a bit more debugging :)

Comment 7

[Firefox Bug Husbandry Bot]

See bug 1547409. Moving webcompat whiteboard tags to project flags.