[LayoutNG] Fix nested legacy oof descendants

Another fix for "Legacy OOF descendant did not get laid out" The cause here was: - if #container had a legacy descendant, and - legacy descendant had an oof descendant whose containing block was #container, that oof descendant would get added to #container's list of legacy oof, but would never get laid out. This bug was hidden, because it would not happen if layout happened twice, which we often do. Seen in the wild at https://www.humblebundle.com/ when scrolling down. Bug: 946986 Change-Id: I183f3d5dfe79b49c5c6aadad0ee2cfcb8bb6849f Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1546713 Commit-Queue: Aleks Totic <[email protected]> Reviewed-by: Ian Kilpatrick <[email protected]> Auto-Submit: Aleks Totic <[email protected]> Cr-Commit-Position: refs/heads/master@{#646077}
web-platform-tests · Jul 23, 2019 · 0335d05 · 0335d05
1 parent 90589d6
commit 0335d05
Showing 1 changed file with 41 additions and 0 deletions.
diff --git a/css/css-position/position-absolute-crash-chrome-004.html b/css/css-position/position-absolute-crash-chrome-004.html
@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<title>CSS Position Absolute: Chrome crash</title>
+<link rel="author" href="mailto:[email protected]">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=946986">
+<meta name="assert" content="Nested abs/fixed/flex do not crash">
+<style>
+  body { overflow: scroll;}
+  .container {
+    position: relative;
+    contain: paint;
+  }
+  .flex {
+    display: flex;
+  }
+  .fixed {
+    position: fixed;
+  }
+  .abs {
+    position: absolute;
+  }
+</style>
+<!-- LayoutNG currently does not support display:flex.
+  Propagation of descendants across flex boundaries is error prone -->
+<div id="one" class="container" style="">
+  <div class="flex">
+    <div class="abs">
+      <div class="flex">
+        <div id="fixed1" class="fixed">
+          <div id="fixed2" class="fixed"></div>
+        </div>
+      </div>
+    </div>
+  </div>
+</div>
+<script>
+test(() => {
+}, 'test passes if it does not crash');
+</script>
+