tree c5fc03dbb979ef2afbced873fc15fac495d19ff0
parent 34174a34dcf4867710d89a5d0c6e460d14a817d8
author mstensho@opera.com <mstensho@opera.com> 1433838636 +0000
committer mstensho@opera.com <mstensho@opera.com> 1433838636 +0000

Use the container() chain when locating the containing flow thread.

Using containingBlock() caused us to miss relatively positioned inlines (that
serve as containing blocks for absolutely positioned descendants), and, more
dangerously (this bug), we'd miss absolutely positioned non-LayoutBlock
ancestors, causing us to find the ancestral flow thread, even though we were
not contained by it. This would in turn make us assume that the multicol
container had column content, which in turn would make us just blindly assume
that there was a column set object there.

A video element establishes a shadow DOM, and if the video was absolutely
positioned, the elements in there would erroneously find the flow thread,
because we skipped the absolutely positioned ancestral video, because it is
not a LayoutBlock.

While bug 496421 is listed as one of the bugs fixed here, it should be pointed
out that the fix is rather speculative in that regard, since since it's fixing
different but rather related crash than the one in the original report. The
crash was triggered by the same TC, though.

BUG=496421,497524,497435
R=dsinclair@chromium.org,esprehn@chromium.org

Review URL: https://codereview.chromium.org/1156303012

git-svn-id: svn://svn.chromium.org/blink/trunk@196745 bbb929c8-8fbe-4397-9dbb-9b2b20218538