Exclude non-boxes in PaintLayer::Preserves3D()
Transform or preserve-3d doesn't apply to non-replaced inline boxes.
Bug: 1271563, 1273489
Change-Id: Ib271bce60faa19047671e47cb9c0a7578850bdd9
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3313773
Commit-Queue: Xianzhu Wang <wangxianzhu@chromium.org>
Reviewed-by: David Baron <dbaron@chromium.org>
Cr-Commit-Position: refs/heads/main@{#948299}
diff --git a/css/css-transforms/crashtests/preserve3d-inline-hit-test.html b/css/css-transforms/crashtests/preserve3d-inline-hit-test.html
new file mode 100644
index 0000000..b00dbc8
--- /dev/null
+++ b/css/css-transforms/crashtests/preserve3d-inline-hit-test.html
@@ -0,0 +1,9 @@
+<!DOCTYPE HTML>
+<title>CSS Test (Transforms): preserve-3d on inline and hit test</title>
+<link rel="help" href="https://drafts.csswg.org/css-transforms-2/#transform-style-property">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1127348">
+<meta name="assert" content="This should not crash.">
+<span style="transform-style: preserve-3d; position: relative">TEST</span>
+<script>
+document.elementFromPoint(10, 10);
+</script>
