Only disable further fragmentation if fragmentation is on.
With the new call to DisableFurtherFragmentation() in
NGOutOfFlowLayoutPart::GenerateFragment(), we might attempt to disable
fragmentation even if we weren't participating in block fragmentation (a
monolithic OOF, for instance). This would lead to a crash if the
constraint space didn't have a rare-data object.
Bug: 1403467
Change-Id: Icd2e005440f93263511ff68949d40672d4030dd9
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4127783
Reviewed-by: Ian Kilpatrick <ikilpatrick@chromium.org>
Commit-Queue: Morten Stenshorne <mstensho@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1088065}
diff --git a/css/css-multicol/crashtests/monolithic-oof-in-clipped-container.html b/css/css-multicol/crashtests/monolithic-oof-in-clipped-container.html
new file mode 100644
index 0000000..7a35062
--- /dev/null
+++ b/css/css-multicol/crashtests/monolithic-oof-in-clipped-container.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1403467">
+<div style="columns:2; column-fill:auto; height:250px;">
+ <div style="position:relative; overflow:clip; width:100px; height:100px;">
+ <div style="position:absolute; contain:size; width:100px; height:100px;"></div>
+ </div>
+</div>
