Loading this testcase triggers: ###!!! ASSERTION: inline-size less than zero: 'aContainingBlockISize >= 0', file layout/base/nsLayoutUtils.cpp, line 5215

BTW, we should probably sprinkle a few more "calc(1px - 99%)" in property_database.js for properties that don't take negative values, to increase the chance for fuzzers finding assertions like the one above.

Comment on attachment 8765674 [details] [diff] [review] fix Review of attachment 8765674 [details] [diff] [review]: ----------------------------------------------------------------- r=me (Though I have minor concerns about the absolute-value flavoredness of the "AbsoluteSize()" name, which I expressed in bug 1279182 comment 9. They particularly apply to this bug here, since we're explicitly using this function to "deal with" negative values here. And AbsoluteSomething(MaybeNegativeValue) kinda sounds like it's going to take the absolute value, potentially.)

Pushed by mpalmgren@mozilla.com: https://hg.mozilla.org/integration/mozilla-inbound/rev/266f03d1dd69 [css-grid] Deal with calc() with negative percentage that may result in negative track size. r=dholbert https://hg.mozilla.org/integration/mozilla-inbound/rev/dc68d1b0e247 [css-grid] Adding reftests for calc(Npx - M%) track sizes.

https://hg.mozilla.org/mozilla-central/rev/266f03d1dd69 https://hg.mozilla.org/mozilla-central/rev/dc68d1b0e247