layout: Floor the max-content size by the min-content size (#36518)

It's typically a given that the min-content size can't exceed the
max-content size. However, it was possible to break that assumption when
an inline formatting context had contents with a negative outer size
(due to margins). This could lead to assert failures.

This patch avoids the problem by flooring the max-content size to not be
smaller than the min-content size. Note there is no interoperability:
https://github.com/w3c/csswg-drafts/issues/12076

Testing: adding new reftest and crashtest
Fixes: #36481

Signed-off-by: Oriol Brufau <obrufau@igalia.com>

1 files changed, 8 insertions, 2 deletions

diff --git a/components/layout_2020/flow/inline/mod.rs b/components/layout_2020/flow/inline/mod.rs
index a93956e8472..1f686120c32 100644
--- a/components/layout_2020/flow/inline/mod.rs
+++ b/components/layout_2020/flow/inline/mod.rs
@@ -2285,10 +2285,16 @@ impl<'layout_data> ContentSizesComputation<'layout_data> {
         for inline_item in inline_formatting_context.inline_items.iter() {
             self.process_item(&inline_item.borrow(), inline_formatting_context);
         }
-
         self.forced_line_break();
+
+        // We might get a max-content size which is smaller than the min-content size,
+        // due to negative margins. So we need to adjust to avoid problems down the line.
+        // This is being discussed in <https://github.com/w3c/csswg-drafts/issues/12076>.
+        let mut sizes = self.paragraph;
+        sizes.max_content.max_assign(sizes.min_content);
+
         InlineContentSizesResult {
-            sizes: self.paragraph,
+            sizes,
             depends_on_block_constraints: self.depends_on_block_constraints,
         }
     }