Don't expose a repeated table header to child iframes.
That was of course bad in the first place, but now with
LayoutNGFragmentTraversal enabled, the child iframe may be
fragment-traversable (because it's laid out with LayoutNG), while the
IFRAME element in the parent document may be inside legacy block
fragmentation. We'd end up creating multiple FragmentData objects for
the layout objects inside the IFRAME document, which is more harmful
with LayoutNGFragmentTraversal, since we expect that the number of
physical fragments be identical to the number of FragmentData objects.
Additionally reset the is_in_block_fragmentation flag when entering
frames. Leaving this unchanged didn't cause any known problems, but it's
wrong to let child frames inherit this state.
Bug: 1260855
Change-Id: Ic416f2213772d986da3597a86131e9d7956e21f9
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3234964
Reviewed-by: Xianzhu Wang <wangxianzhu@chromium.org>
Commit-Queue: Morten Stenshorne <mstensho@chromium.org>
Cr-Commit-Position: refs/heads/main@{#933975}
diff --git a/css/css-break/iframe-in-repeated-table-header-crash.html b/css/css-break/iframe-in-repeated-table-header-crash.html
new file mode 100644
index 0000000..8956bc7
--- /dev/null
+++ b/css/css-break/iframe-in-repeated-table-header-crash.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1260855">
+<div style="columns:2; column-fill:auto; height:200px;">
+ <table>
+ <thead style="break-inside:avoid;">
+ <tr>
+ <td>
+ <iframe style="height:10px;"></iframe>
+ </td>
+ </tr>
+ </thead>
+ <tbody>
+ <tr>
+ <td>
+ <div style="height:100px;"></div>
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <div style="height:100px;"></div>
+ </td>
+ </tr>
+ </tbody>
+ </table>
+</div>
