[FlexNG] Fix flex-item grid layout explosion.

When we had a column flex-item, which was also a grid, where the percent template added up to something >100% on each layout the grid would grow larger. This was caused by some logic to fix relative-positioned children in: https://chromium-review.googlesource.com/c/chromium/src/+/2093273 However when this value was read within layout, it could refer to the previous layout. If numerous layouts occurred sequentially, this would cause the layouts to grow unbounded. This patch disables this path when read during layout for a flex-item (in NG). During layout the flex-item should have a BoxLayoutExtraInput set. Bug: 1108928 Change-Id: I4d0d41755c9d33eb2b4c217ee6bfdb1acd48cbbf Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2320418Reviewed-by: David Grogan <dgrogan@chromium.org> Commit-Queue: David Grogan <dgrogan@chromium.org> Cr-Commit-Position: refs/heads/master@{#792193}

[FlexNG] Fix flex-item grid layout explosion.
When we had a column flex-item, which was also a grid, where the percent template added up to something >100% on each layout the grid would grow larger. This was caused by some logic to fix relative-positioned children in: https://chromium-review.googlesource.com/c/chromium/src/+/2093273 However when this value was read within layout, it could refer to the previous layout. If numerous layouts occurred sequentially, this would cause the layouts to grow unbounded. This patch disables this path when read during layout for a flex-item (in NG). During layout the flex-item should have a BoxLayoutExtraInput set. Bug: 1108928 Change-Id: I4d0d41755c9d33eb2b4c217ee6bfdb1acd48cbbf Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2320418Reviewed-by: David Grogan <dgrogan@chromium.org> Commit-Queue: David Grogan <dgrogan@chromium.org> Cr-Commit-Position: refs/heads/master@{#792193}
01777f31 · Ian Kilpatrick · Commit Bot · a3de7c8d · 01777f31 · 01777f31
Commit 01777f31 authored Jul 28, 2020 by Ian Kilpatrick Committed by Commit Bot Jul 28, 2020
2 changed files
--- a/third_party/blink/renderer/core/layout/layout_box.cc
+++ b/third_party/blink/renderer/core/layout/layout_box.cc
@@ -4535,11 +4535,14 @@ LayoutUnit LayoutBox::AvailableLogicalHeightUsing(
    } else if (HasOverrideLogicalHeight() &&
               IsOverrideLogicalHeightDefinite()) {
      return OverrideContentLogicalHeight();
-    } else if (const auto* previous_result = GetCachedLayoutResult()) {
+    } else if (!GetBoxLayoutExtraInput()) {
-      const NGConstraintSpace& space =
+      // TODO(ikilpatrick): Remove this post M86.
-          previous_result->GetConstraintSpaceForCaching();
+      if (const auto* previous_result = GetCachedLayoutResult()) {
-      if (space.IsFixedBlockSize() && !space.IsFixedBlockSizeIndefinite())
+        const NGConstraintSpace& space =
-        return space.AvailableSize().block_size;
+            previous_result->GetConstraintSpaceForCaching();
+        if (space.IsFixedBlockSize() && !space.IsFixedBlockSizeIndefinite())
+          return space.AvailableSize().block_size;
+      }
    }
  }

--- a/third_party/blink/web_tests/external/wpt/css/css-flexbox/grid-flex-item-005.html
+++ b/third_party/blink/web_tests/external/wpt/css/css-flexbox/grid-flex-item-005.html
+<!DOCTYPE html>
+<link rel="help" href="https://crbug.com/1108928">
+<link rel="match" href="../reference/ref-filled-green-100px-square-only.html">
+<p>Test passes if there is a filled green square.</p>
+<div id="target">
+  <div style="display: flex; flex-direction: column">
+    <div style="display: grid; height: 0; flex: 1; grid-template-rows: minmax(100px, 200%);">
+      <div style="background: green;"></div>
+    </div>
+  </div>
+</div>
+<script>
+document.body.offsetTop;
+document.getElementById('target').style.width = '100px';
+</script>