Fix crash when block or text have negative sizes (#5610)

1 files changed, 18 insertions, 0 deletions

diff --git a/crates/typst-layout/src/flow/block.rs b/crates/typst-layout/src/flow/block.rs
index 71eacc1c..6c2c3923 100644
--- a/crates/typst-layout/src/flow/block.rs
+++ b/crates/typst-layout/src/flow/block.rs
@@ -364,6 +364,12 @@ fn breakable_pod<'a>(
 
 /// Distribute a fixed height spread over existing regions into a new first
 /// height and a new backlog.
+///
+/// Note that, if the given height fits within the first region, no backlog is
+/// generated and the first region's height shrinks to fit exactly the given
+/// height. In particular, negative and zero heights always fit in any region,
+/// so such heights are always directly returned as the new first region
+/// height.
 fn distribute<'a>(
     height: Abs,
     mut regions: Regions,
@@ -371,7 +377,19 @@ fn distribute<'a>(
 ) -> (Abs, &'a mut [Abs]) {
     // Build new region heights from old regions.
     let mut remaining = height;
+
+    // Negative and zero heights always fit, so just keep them.
+    // No backlog is generated.
+    if remaining <= Abs::zero() {
+        buf.push(remaining);
+        return (buf[0], &mut buf[1..]);
+    }
+
     loop {
+        // This clamp is safe (min <= max), as 'remaining' won't be negative
+        // due to the initial check above (on the first iteration) and due to
+        // stopping on 'remaining.approx_empty()' below (for the second
+        // iteration onwards).
         let limited = regions.size.y.clamp(Abs::zero(), remaining);
         buf.push(limited);
         remaining -= limited;