tree 00e1fb3ee9a10963e9463ac364a8a7f98de730aa
parent afcdec23f59fdb07a84075af9c06d1b4307e76b1
author Alison Maher <almaher@microsoft.com> 1624481398 -0700
committer Blink WPT Bot <blink-w3c-test-autoroller@chromium.org> 1624482274 -0700

[LayoutNG] Multicol with OOF contained by inline ancestor

An OOF with an inline containing block that is a direct child of a
multicol crashed because the containing block of the inline element was
detected to be the LayoutFlowThread. The reason being that
LayoutObject::FindNonAnonymousContainingBlock() checks
IsAnonymousBlock() when finding the containing block, which can be
a LayoutFlowThread. However, IsAnonymousBlock() also skips over the
anonymous wrapper of the inline container. We want to use this as the
containing block instead so that we don't end up using the
multicol as the containing block.

To accomplish this, add a new bitfield for the inline NG wrapper that
is a direct child of a flow thread in LayoutObject, and allow this to be
the containing block in LayoutObject::FindNonAnonymousContainingBlock().

Bug: 1079031
Change-Id: I90dc78fc541abf2a93a62da808542787a3ad2e6f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2938502
Commit-Queue: Alison Maher <almaher@microsoft.com>
Reviewed-by: Morten Stenshorne <mstensho@chromium.org>
Reviewed-by: Aleks Totic <atotic@chromium.org>
Cr-Commit-Position: refs/heads/master@{#895300}