tree bbc0f81596c35d0d9baebf5c31607a8663cd695f
parent 3cd617562c0401a364065aaee9b3ae213bc44dd7
author Morten Stenshorne <mstensho@chromium.org> 1659616102 -0700
committer Blink WPT Bot <blink-w3c-test-autoroller@chromium.org> 1659616827 -0700

Correct multicol min/max with inline-size containment.

Without this fix, we used to make room for column spanners, which is
wrong if inline-size containment should apply.

Make an existing test more evil, so that it would fail without this fix.

This also fixes a crash, which is what crbug.com/1348714 really was
about. We used to lay out with stale NGInlineNodeData. NGInlineNodeData
used to get updated during min/max calculation (because we didn't honor
size containment), and that takes place (via
CalculateInitialFragmentGeometry() in NGBlockNode::Layout()) before
container query evaluation (which will update the layout object tree
structure). Apparently we don't update NGInlineNodeData again once we
get to actual layout. It could be that there's an underlying cause that
still needs to be addressed here. If someone is unlucky enough to do an
NGInlineNode::PrepareLayoutIfNeeded() before container query evaluation,
it seems that we might end up with stale NGInlineNodeData.

Bug: 1348714
Change-Id: I1996f95138050778ea05d7b20b5301b57c94695a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3807462
Reviewed-by: Koji Ishii <kojii@chromium.org>
Commit-Queue: Morten Stenshorne <mstensho@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1031461}