[LayoutNG] Multi-column containing blocks

Currently, when a multi-column is a containing block for an OOF
positioned element, the corresponding column is mistaken for the
containing block, which causes various DCHECK failures. Columns are not
allowed to be containing blocks, so this change ensures that we skip
over columns when placing OOF positioned elements.

Bug: 1158706
Change-Id: Id969b91a8f472d34b4767ffe891a3405770e8443
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2597769
Commit-Queue: Alison Maher <almaher@microsoft.com>
Reviewed-by: Morten Stenshorne <mstensho@chromium.org>
Cr-Commit-Position: refs/heads/master@{#838476}

third_party/blink/renderer/core/layout/ng/ng_block_node.cc

@@ -1227,7 +1227,14 @@ void NGBlockNode::PlaceChildrenInFlowThread(
     const auto& child_fragment = To<NGPhysicalBoxFragment>(*child);
     const auto* child_box = To<LayoutBox>(child_fragment.GetLayoutObject());
     if (child_box && child_box != box_) {
-      DCHECK(child_box->IsColumnSpanAll());
+      if (!child_box->IsColumnSpanAll()) {
+        // TODO(almaher): In order for legacy tree operations to work properly,
+        // we need to CopyChildFragmentPosition(). We should probably also
+        // update the LayoutBox size at the last fragment of an OOF node.
+        // (See comments in CL:2597769).
+        DCHECK(child_box->IsOutOfFlowPositioned());
+        continue;
+      }
       CopyChildFragmentPosition(child_fragment, child.offset,
                                 physical_fragment);
       LayoutBox* placeholder = child_box->SpannerPlaceholder();

third_party/blink/renderer/core/layout/ng/ng_out_of_flow_layout_part.cc

@@ -1008,6 +1008,10 @@ scoped_refptr<const NGLayoutResult> NGOutOfFlowLayoutPart::Layout(
 
 bool NGOutOfFlowLayoutPart::IsContainingBlockForCandidate(
     const NGLogicalOutOfFlowPositionedNode& candidate) {
+  // Column boxes are not allowed to be containing blocks.
+  if (container_builder_->IsFragmentainerBoxType())
+    return false;
+
   EPosition position = candidate.node.Style().GetPosition();
 
   // Candidates whose containing block is inline are always positioned inside

third_party/blink/web_tests/TestExpectations

@@ -1038,9 +1038,7 @@ crbug.com/1146973 virtual/layout_ng_block_frag/external/wpt/css/css-break/out-of
 crbug.com/1079031 virtual/layout_ng_block_frag/external/wpt/css/css-multicol/change-out-of-flow-type-and-remove-inner-multicol-crash.html [ Crash Failure ]
 crbug.com/1058792 virtual/layout_ng_block_frag/external/wpt/css/css-multicol/composited-under-clip-under-multicol.html [ Failure Crash ]
 crbug.com/996655 virtual/layout_ng_block_frag/external/wpt/css/css-multicol/going-out-of-flow-after-spanner.html [ Crash Failure Pass ]
-crbug.com/1079031 virtual/layout_ng_block_frag/external/wpt/css/css-multicol/multicol-containing-002.xht [ Crash Failure ]
 crbug.com/1079031 virtual/layout_ng_block_frag/external/wpt/css/css-multicol/multicol-fill-auto-002.xht [ Crash Failure ]
-crbug.com/1079031 virtual/layout_ng_block_frag/external/wpt/css/css-multicol/multicol-fill-balance-001.xht [ Crash Failure ]
 crbug.com/829028 virtual/layout_ng_block_frag/external/wpt/css/css-multicol/multicol-inherit-001.xht [ Failure ]
 crbug.com/829028 virtual/layout_ng_block_frag/external/wpt/css/css-multicol/multicol-inherit-002.xht [ Failure ]
 crbug.com/829028 virtual/layout_ng_block_frag/external/wpt/css/css-multicol/multicol-nested-002.xht [ Failure ]
@@ -1096,7 +1094,6 @@ crbug.com/1079031 virtual/layout_ng_block_frag/fast/multicol/out-of-flow/abspos-
 crbug.com/1079031 virtual/layout_ng_block_frag/fast/multicol/out-of-flow/abspos-auto-position-on-line-rtl.html [ Failure ]
 crbug.com/1079031 virtual/layout_ng_block_frag/fast/multicol/out-of-flow/nested-multicol.html [ Failure ]
 crbug.com/829028 virtual/layout_ng_block_frag/fast/multicol/overflowing-columns-large-gaps.html [ Failure ]
-crbug.com/1079031 virtual/layout_ng_block_frag/fast/multicol/positioned-outside-of-columns.html [ Crash Failure ]
 crbug.com/1079031 virtual/layout_ng_block_frag/fast/multicol/positioned-split.html [ Failure ]
 crbug.com/1058792 virtual/layout_ng_block_frag/fast/multicol/span/invalid-spanner-in-transform.html [ Failure Crash ]
 crbug.com/829028 virtual/layout_ng_block_frag/fast/multicol/span/outer-column-break-after-inner-spanner-2.html [ Failure ]

third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-containing-003.html

+<!DOCTYPE html>
+<link rel="help" href="https://drafts.csswg.org/css-multicol/#the-multi-column-model">
+<link rel="match" href="../reference/ref-filled-green-100px-square.xht">
+<style>
+  #multicol {
+    columns: 2;
+    width: 100px;
+    height: 100px;
+    column-fill: auto;
+    column-gap: 0px;
+  }
+  .rel {
+    position: relative;
+  }
+  .abs {
+    position: absolute;
+    width: 100px;
+    height: 100px;
+    background: green;
+    top: 0;
+    left: 0;
+  }
+</style>
+<p>Test passes if there is a filled green square and <strong>no red</strong>.</p>
+<div class="rel" id="multicol">
+  <div style="height:200px; width: 50px; background: red;"></div>
+  <div class="abs"></div>
+</div>