offsetWidth on a table cell with fixed width is wrong

TableCell's width is layout dependent, even when specified
via width: Npx in CSS.

Hopefully there are not other cases which are missing from this
optimization.  This code is very fragile as written.
We should make this a white-list instead of a black-list
for this optimization.

BUG=290399

Review URL: https://codereview.chromium.org/25086004

git-svn-id: svn://svn.chromium.org/blink/trunk@158467 bbb929c8-8fbe-4397-9dbb-9b2b20218538
diff --git a/LayoutTests/fast/table/table-cell-offset-width-expected.txt b/LayoutTests/fast/table/table-cell-offset-width-expected.txt
new file mode 100644
index 0000000..c2dbb3d
--- /dev/null
+++ b/LayoutTests/fast/table/table-cell-offset-width-expected.txt
@@ -0,0 +1 @@
+PASS (36px)
diff --git a/LayoutTests/fast/table/table-cell-offset-width.html b/LayoutTests/fast/table/table-cell-offset-width.html
new file mode 100644
index 0000000..0a77d22
--- /dev/null
+++ b/LayoutTests/fast/table/table-cell-offset-width.html
@@ -0,0 +1,10 @@
+<table><td style="font: Ahem; width: 10px">FAIL</td></table>
+<script>
+if (window.testRunner)
+	testRunner.dumpAsText();
+// crbug.com/290399 reported that offsetWidth on a table cell
+// would incorrectly return the specified width instead of the layout-expanded width.
+// When this would fail, it would be 12px instead of the 36px 'FAIL' expands to in Ahem.
+var width = document.getElementsByTagName('td')[0].offsetWidth;
+document.body.textContent = (width == 36 ? "PASS" : "FAIL") + " (" + width + "px)";
+</script>
diff --git a/Source/core/rendering/RenderBox.cpp b/Source/core/rendering/RenderBox.cpp
index aa800cb..b0cd4d7 100644
--- a/Source/core/rendering/RenderBox.cpp
+++ b/Source/core/rendering/RenderBox.cpp
@@ -420,7 +420,9 @@
         || style->boxSizing() == BORDER_BOX
         || !isRenderBlock()
         || !isRenderBlockFlow()
-        || isFlexItemIncludingDeprecated();
+        || isFlexItemIncludingDeprecated()
+        // TableCells can expand beyond a specified width.
+        || isTableCell();
 }
 
 LayoutUnit RenderBox::fixedOffsetWidth() const