commit 24c93b3dcd52fa7af6b213b725fad738cfd88e5d
author Koji Ishii <kojii@chromium.org> Mon Jun 13 15:31:07 2022
committer Chromium LUCI CQ <chromium-scoped@luci-project-accounts.iam.gserviceaccount.com> Mon Jun 13 15:31:07 2022
tree 06c554e4218be35b8de58744ba0f72a9220da901
parent 92e283e56e7cfd6ee938b0d79b38bbb797bc7829

Merge 5060: [block-in-inline] Fix duplicated items in outline rects

This patch fixes a problem when |NGPhysicalFragment::
AddOutlineRectsForCursor| may add multiple rects for a
fragment. This happens because when it finds a box item,
it calls |AddOutlineRectsForDescendant| that adds all its
descendants, but still moves the cursor to next in the DFS
order.

When deep nesting occurs, it can create the n! number of
rects when n is the nest level of non-culled inline boxes.

This is an old issue, but the block-in-inline made creating
deep trees easier, and making them non-culled in r980432
crrev.com/c/3486321 made it easier to hit.

(cherry picked from commit 1378e8c7211152bd2ec56d84bbcbe2b649bcd818)

Bug: 1333283, 1324517
Change-Id: I2ab439219bfa890f34901de6fd8c72d1b44e1b20
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3696277
Reviewed-by: Kent Tamura <tkent@chromium.org>
Auto-Submit: Koji Ishii <kojii@chromium.org>
Commit-Queue: Kent Tamura <tkent@chromium.org>
Cr-Original-Commit-Position: refs/heads/main@{#1012364}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3698510
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Koji Ishii <kojii@chromium.org>
Cr-Commit-Position: refs/branch-heads/5060@{#784}
Cr-Branched-From: b83393d0f4038aeaf67f970a024d8101df7348d1-refs/heads/main@{#1002911}