[PE] Re-land: Recompute overflow for tables

This is a re-land of commit bc976225,
which had a type-casting bug due to failure to override child
overflow recursion. The new patch also includes a test adjustment
and DCHECK to avoid such security bugs.

Bug: 807900,808876
Change-Id: I9210cf48b25ca255ceccd955fd4699e76620f90f
Reviewed-on: https://chromium-review.googlesource.com/902763Reviewed-by: Stephen Chenney <schenney@chromium.org>
Commit-Queue: Chris Harrelson <chrishtr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#534785}

third_party/WebKit/Source/core/layout/LayoutBlock.cpp

@@ -1998,6 +1998,7 @@ bool LayoutBlock::RecalcNormalFlowChildOverflowIfNeeded(
 }
 
 bool LayoutBlock::RecalcChildOverflowAfterStyleChange() {
+  DCHECK(!IsTable());
   DCHECK(ChildNeedsOverflowRecalcAfterStyleChange());
   ClearChildNeedsOverflowRecalcAfterStyleChange();
 
@@ -2041,6 +2042,11 @@ bool LayoutBlock::RecalcOverflowAfterStyleChange() {
   if (!self_needs_overflow_recalc && !children_overflow_changed)
     return false;
 
+  return RecalcSelfOverflowAfterStyleChange();
+}
+
+bool LayoutBlock::RecalcSelfOverflowAfterStyleChange() {
+  bool self_needs_overflow_recalc = SelfNeedsOverflowRecalcAfterStyleChange();
   ClearSelfNeedsOverflowRecalcAfterStyleChange();
   // If the current block needs layout, overflow will be recalculated during
   // layout time anyway. We can safely exit here.

third_party/WebKit/Source/core/layout/LayoutBlock.h

@@ -318,6 +318,7 @@ class CORE_EXPORT LayoutBlock : public LayoutBox {
  protected:
   bool RecalcNormalFlowChildOverflowIfNeeded(LayoutObject*);
   bool RecalcPositionedDescendantsOverflowAfterStyleChange();
+  bool RecalcSelfOverflowAfterStyleChange();
 
  public:
   bool RecalcChildOverflowAfterStyleChange();

third_party/WebKit/Source/core/layout/LayoutTable.cpp

@@ -563,6 +563,8 @@ void LayoutTable::SimplifiedNormalFlowLayout() {
 }
 
 bool LayoutTable::RecalcOverflowAfterStyleChange() {
+  RecalcSelfOverflowAfterStyleChange();
+
   if (!ChildNeedsOverflowRecalcAfterStyleChange())
     return false;
   ClearChildNeedsOverflowRecalcAfterStyleChange();

third_party/WebKit/Source/core/layout/LayoutTableTest.cpp

@@ -18,6 +18,30 @@ class LayoutTableTest : public RenderingTest {
   }
 };
 
+TEST_F(LayoutTableTest, OverflowViaOutline) {
+  SetBodyInnerHTML(R"HTML(
+    <style>
+      div { display: table; width: 100px; height: 200px; }
+    </style>
+    <div id=target>
+      <div id=child></div>
+    </div>
+  )HTML");
+  auto* target = GetTableByElementId("target");
+  EXPECT_EQ(LayoutRect(0, 0, 100, 200), target->SelfVisualOverflowRect());
+  ToElement(target->GetNode())
+      ->setAttribute(HTMLNames::styleAttr, "outline: 2px solid black");
+
+  auto* child = GetTableByElementId("child");
+  ToElement(child->GetNode())
+      ->setAttribute(HTMLNames::styleAttr, "outline: 2px solid black");
+
+  target->GetFrameView()->UpdateAllLifecyclePhases();
+  EXPECT_EQ(LayoutRect(-2, -2, 104, 204), target->SelfVisualOverflowRect());
+
+  EXPECT_EQ(LayoutRect(-2, -2, 104, 204), child->SelfVisualOverflowRect());
+}
+
 TEST_F(LayoutTableTest, OverflowWithCollapsedBorders) {
   SetBodyInnerHTML(R"HTML(
     <style>