Use the container() chain when locating the containing flow thread.
Using containingBlock() caused us to miss relatively positioned inlines (that
serve as containing blocks for absolutely positioned descendants), and, more
dangerously (this bug), we'd miss absolutely positioned non-LayoutBlock
ancestors, causing us to find the ancestral flow thread, even though we were
not contained by it. This would in turn make us assume that the multicol
container had column content, which in turn would make us just blindly assume
that there was a column set object there.
A video element establishes a shadow DOM, and if the video was absolutely
positioned, the elements in there would erroneously find the flow thread,
because we skipped the absolutely positioned ancestral video, because it is
not a LayoutBlock.
While bug 496421 is listed as one of the bugs fixed here, it should be pointed
out that the fix is rather speculative in that regard, since since it's fixing
different but rather related crash than the one in the original report. The
crash was triggered by the same TC, though.
BUG=496421,497524,497435
R=dsinclair@chromium.org,esprehn@chromium.org
Review URL: https://codereview.chromium.org/1156303012
git-svn-id: svn://svn.chromium.org/blink/trunk@196745 bbb929c8-8fbe-4397-9dbb-9b2b20218538
3 files changed
