Ignore auto z-index when determining IsReplacedNormalFlowStacking.
<foreignObject> is the only element which can be replaced normal flow stacking,
and this element cannot be z-indexed.
Bug: 862635
Cq-Include-Trybots: luci.chromium.try:linux_layout_tests_slimming_paint_v2;master.tryserver.blink:linux_trusty_blink_rel
Change-Id: Ia82a7c648da1d407b38330b7daa280d2baf39d49
Reviewed-on: https://chromium-review.googlesource.com/1137351
Commit-Queue: Chris Harrelson <chrishtr@chromium.org>
Reviewed-by: vmpstr <vmpstr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#575743}diff --git a/third_party/WebKit/LayoutTests/svg/foreignObject/z-index-crash.html b/third_party/WebKit/LayoutTests/svg/foreignObject/z-index-crash.html
new file mode 100644
index 0000000..d763541
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/svg/foreignObject/z-index-crash.html
@@ -0,0 +1,14 @@
+<!doctype HTML>
+<script src="../../resources/testharness.js"></script>
+<script src="../../resources/testharnessreport.js"></script>
+Passes if it does not crash.
+<svg>
+ <style>
+ </style>
+ <foreignObject style="z-index: 0">
+ test
+ </foreignObject>
+</svg>
+<script>
+ test(() => { }, "No crash or assertion failure.");
+</script>
diff --git a/third_party/blink/renderer/core/paint/paint_layer.cc b/third_party/blink/renderer/core/paint/paint_layer.cc
index 44baedf..db45126 100644
--- a/third_party/blink/renderer/core/paint/paint_layer.cc
+++ b/third_party/blink/renderer/core/paint/paint_layer.cc
@@ -2326,11 +2326,7 @@
}
bool PaintLayer::IsReplacedNormalFlowStacking() const {
- if (!GetLayoutObject().IsSVGForeignObject())
- return false;
- if (!GetLayoutObject().StyleRef().HasAutoZIndex())
- return false;
- return true;
+ return GetLayoutObject().IsSVGForeignObject();
}
void PaintLayer::SetNeedsCompositingLayerAssignment() {
