[LayoutNG] Fixed crash issue when LI + zero height checkbox

List marker would resolve the bfc block_offset, but it didn't continue
to resolve its parent's. So it's possible that the bfc block_offset of
LI isn't resolved after layout list marker which will cause crash issue.
This patch make LI resolve it after layout list marker.

Bug: 969741
Change-Id: I1e1f2500217c51f24cb2633002d9a78ca1088d6c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1645135
Commit-Queue: cathie chen <cathiechen@igalia.com>
Reviewed-by: Ian Kilpatrick <ikilpatrick@chromium.org>
Reviewed-by: Morten Stenshorne <mstensho@chromium.org>
Reviewed-by: Koji Ishii <kojii@chromium.org>
Cr-Commit-Position: refs/heads/master@{#672853}
diff --git a/css/css-lists/list-and-margin-collapse-002.html b/css/css-lists/list-and-margin-collapse-002.html
new file mode 100644
index 0000000..ef110ca
--- /dev/null
+++ b/css/css-lists/list-and-margin-collapse-002.html
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Lists: test the margin collapse of marker</title>
+<link rel=help href="https://www.w3.org/TR/CSS22/generate.html#lists">
+<link rel="help" href="http://crbug.com/969741">
+
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+
+<div id="log"></div>
+
+<div id="target_with_marker" style="overflow:hidden; width:100px;">
+  <div style="margin-bottom:100px;"></div>
+  <div style="display:list-item; margin-left:100px; height:0px;"></div>
+  <div style="margin-top:100px;"></div>
+</div>
+
+<div id="target_without_marker" style="overflow:hidden; width:100px;">
+  <div style="margin-bottom:100px;"></div>
+  <div style="display:list-item; margin-left:100px; list-style:none;"></div>
+  <div style="margin-top:100px;"></div>
+</div>
+
+<script>
+test(function() {
+  var height_with_marker = document.getElementById("target_with_marker").clientHeight;
+  assert_equals(height_with_marker, 200, "Should not allow margin-collapsing through if list is with marker.");
+  var height_without_marker = document.getElementById("target_without_marker").clientHeight;
+  assert_equals(height_without_marker, 100, "Should allow margin-collapsing through if list is without marker.");
+}, "list and margin collapse");
+</script>
diff --git a/css/css-lists/list-and-margin-collapse-003.html b/css/css-lists/list-and-margin-collapse-003.html
new file mode 100644
index 0000000..78dcbc6
--- /dev/null
+++ b/css/css-lists/list-and-margin-collapse-003.html
@@ -0,0 +1,39 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Lists: test the margin collapse of marker</title>
+<link rel=help href="https://www.w3.org/TR/CSS22/generate.html#lists">
+<link rel="help" href="http://crbug.com/969741">
+
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+
+<style type="text/css">
+.checkbox{
+  -moz-appearance: checkbox;
+  -webkit-appearance: checkbox;
+  height: 0px;
+}
+</style>
+
+<div id="log"></div>
+
+<div id="target_with_marker" style="overflow:hidden; width:100px;">
+  <div style="margin-bottom:100px;"></div>
+  <div style="display:list-item; margin-left:100px; height:0px;"><div class="checkbox"></div></div>
+  <div style="margin-top:100px;"></div>
+</div>
+
+<div id="target_without_marker" style="overflow:hidden; width:100px;">
+  <div style="margin-bottom:100px;"></div>
+  <div style="display:list-item; margin-left:100px; list-style:none;"><div class="checkbox"></div></div>
+  <div style="margin-top:100px;"></div>
+</div>
+
+<script>
+test(function() {
+  var height_with_marker = document.getElementById("target_with_marker").clientHeight;
+  assert_equals(height_with_marker, 200, "Should not allow margin-collapsing through if list is with marker.");
+  var height_without_marker = document.getElementById("target_without_marker").clientHeight;
+  assert_equals(height_without_marker, 100, "Should allow margin-collapsing through if list is without marker.");
+}, "list and margin collapse");
+</script>
diff --git a/css/css-lists/list-and-margin-collapse-004.html b/css/css-lists/list-and-margin-collapse-004.html
new file mode 100644
index 0000000..4a92f8b
--- /dev/null
+++ b/css/css-lists/list-and-margin-collapse-004.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<title>Test if it doesn't crash when resolving BFC block-offset abort</title>
+<link rel=help href="https://www.w3.org/TR/CSS22/generate.html#lists">
+<link rel="help" href="http://crbug.com/969741">
+
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<style type="text/css">
+#checkbox{
+  -moz-appearance: checkbox;
+  -webkit-appearance: checkbox;
+  height: 0px;
+}
+</style>
+<body>
+  <div style="float: left; width: 100px; height: 100px;"></div>
+  <div style="display: list-item;">
+    <div id="checkbox"></div>
+  </div>
+<script>
+test(() => {}, "Layout should not crash");
+</script>
+</body>