[FragmentItem] Skip already added children in CreateBoxFragment
FragmentItem keeps all inline items in a flat list. When
inline box fragments are nested, |CreateBoxFragment| handles
the same item twice; once for its parent and another for its
grand parent.
This patch fixes this by skipping non-direct children.
Bug: 1096957
Change-Id: If5acba0c5bd687d156cc4530fbe6123bca9840ab
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2251643
Reviewed-by: Yoshifumi Inoue <yosin@chromium.org>
Commit-Queue: Koji Ishii <kojii@chromium.org>
Cr-Commit-Position: refs/heads/master@{#780231}
diff --git a/css/CSS2/positioning/abspos-inline-container-in-inline-block.html b/css/CSS2/positioning/abspos-inline-container-in-inline-block.html
new file mode 100644
index 0000000..04eb141
--- /dev/null
+++ b/css/CSS2/positioning/abspos-inline-container-in-inline-block.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<link rel="help" href="https://drafts.csswg.org/css2/visuren.html#propdef-position">
+<link rel="author" title="Koji Ishii" href="mailto:kojii@chromium.org">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div>
+ <span style="border: 1px solid blue">
+ <span style="position: relative">
+ <span style="display: inline-block">
+ <span style="position: absolute; background: orange; width: 100px; height: 100px"></span>
+ </span>
+ </span>
+ </span>
+</div>
+<script>
+// Test pass if it does not crash.
+test(() => {});
+</script>
