[LayoutNG] Fix nested legacy oof descendants
Another fix for "Legacy OOF descendant did not get laid out"
The cause here was:
- if #container had a legacy descendant, and
- legacy descendant had an oof descendant whose containing block was
#container, that oof descendant would get added to #container's list
of legacy oof, but would never get laid out.
This bug was hidden, because it would not happen if layout happened
twice, which we often do.
Seen in the wild at https://www.humblebundle.com/ when scrolling down.
Bug: 946986
Change-Id: I183f3d5dfe79b49c5c6aadad0ee2cfcb8bb6849f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1546713
Commit-Queue: Aleks Totic <atotic@chromium.org>
Reviewed-by: Ian Kilpatrick <ikilpatrick@chromium.org>
Auto-Submit: Aleks Totic <atotic@chromium.org>
Cr-Commit-Position: refs/heads/master@{#646077}
diff --git a/css/css-position/position-absolute-crash-chrome-004.html b/css/css-position/position-absolute-crash-chrome-004.html
new file mode 100644
index 0000000..cc6de63
--- /dev/null
+++ b/css/css-position/position-absolute-crash-chrome-004.html
@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<title>CSS Position Absolute: Chrome crash</title>
+<link rel="author" href="mailto:atotic@chromium.org">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=946986">
+<meta name="assert" content="Nested abs/fixed/flex do not crash">
+<style>
+ body { overflow: scroll;}
+ .container {
+ position: relative;
+ contain: paint;
+ }
+ .flex {
+ display: flex;
+ }
+ .fixed {
+ position: fixed;
+ }
+ .abs {
+ position: absolute;
+ }
+</style>
+<!-- LayoutNG currently does not support display:flex.
+ Propagation of descendants across flex boundaries is error prone -->
+<div id="one" class="container" style="">
+ <div class="flex">
+ <div class="abs">
+ <div class="flex">
+ <div id="fixed1" class="fixed">
+ <div id="fixed2" class="fixed"></div>
+ </div>
+ </div>
+ </div>
+ </div>
+</div>
+<script>
+test(() => {
+}, 'test passes if it does not crash');
+</script>
+
