[block-in-inline] Fix duplicated items in outline rects
This patch fixes a problem when |NGPhysicalFragment::
AddOutlineRectsForCursor| may add multiple rects for a
fragment. This happens because when it finds a box item,
it calls |AddOutlineRectsForDescendant| that adds all its
descendants, but still moves the cursor to next in the DFS
order.
When deep nesting occurs, it can create the n! number of
rects when n is the nest level of non-culled inline boxes.
This is an old issue, but the block-in-inline made creating
deep trees easier, and making them non-culled in r980432
crrev.com/c/3486321 made it easier to hit.
Bug: 1333283, 1324517
Change-Id: I2ab439219bfa890f34901de6fd8c72d1b44e1b20
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3696277
Reviewed-by: Kent Tamura <tkent@chromium.org>
Auto-Submit: Koji Ishii <kojii@chromium.org>
Commit-Queue: Kent Tamura <tkent@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1012364}
diff --git a/css/css-ui/crashtests/outline-scrollIntoView-crash.html b/css/css-ui/crashtests/outline-scrollIntoView-crash.html
new file mode 100644
index 0000000..58bbd4c
--- /dev/null
+++ b/css/css-ui/crashtests/outline-scrollIntoView-crash.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<link rel="help" title="7.1. 'outline' property" href="http://www.w3.org/TR/css3-ui/#outline">
+<link rel="author" title="Koji Ishii" href="mailto:kojii@chromium.org">
+<body onload="run_test()">
+ <span id="root"></span>
+<script>
+function build_tree(n) {
+ let last_leaf = root;
+ for (let i = 0; i < n; ++i) {
+ const div = document.createElement('div');
+ const inline_box = document.createElement('span');
+ div.appendChild(inline_box);
+ last_leaf.appendChild(div);
+ last_leaf = inline_box;
+ }
+}
+build_tree(30);
+
+function run_test() {
+ root.scrollIntoView();
+}
+</script>
+</body>
