[LayoutNG] Skip "replaced % resolution" quirk on ortho-roots.

This is about an undocumented quirk. I raised
https://github.com/whatwg/quirks/issues/46 for it.

LayoutNG currently cannot handle this situation, because we don't store
the inline-size to use in replaced percentage resolution (only the
block-size). However, I find it hard to believe that there'd be any
specific expectations to how this is supposed to work if a table cell
has a definite block-size, and a descendant establishes an orthogonal
writing-mode root. So just ignore it and use regular percentage size
resolution in these cases.

Bug: 967069
Change-Id: Iac61abe80f4f949017cc161855b2223ec4503812
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1664075Reviewed-by: Ian Kilpatrick <ikilpatrick@chromium.org>
Reviewed-by: Christian Biesinger <cbiesinger@chromium.org>
Commit-Queue: Morten Stenshorne <mstensho@chromium.org>
Cr-Commit-Position: refs/heads/master@{#670126}

third_party/blink/renderer/core/layout/ng/ng_constraint_space_builder.cc

@@ -30,6 +30,7 @@ NGConstraintSpaceBuilder& NGConstraintSpaceBuilder::SetPercentageResolutionSize(
     LogicalSize percentage_resolution_size) {
 #if DCHECK_IS_ON()
   DCHECK(is_available_size_set_);
+  is_percentage_resolution_size_set_ = true;
 #endif
   if (LIKELY(is_in_parallel_flow_)) {
     space_.bitfields_.percentage_inline_storage =
@@ -76,6 +77,7 @@ NGConstraintSpaceBuilder::SetReplacedPercentageResolutionSize(
     LogicalSize replaced_percentage_resolution_size) {
 #if DCHECK_IS_ON()
   DCHECK(is_available_size_set_);
+  DCHECK(is_percentage_resolution_size_set_);
 #endif
   if (LIKELY(is_in_parallel_flow_)) {
     // We don't store the replaced percentage resolution inline size, so we need
@@ -92,20 +94,21 @@ NGConstraintSpaceBuilder::SetReplacedPercentageResolutionSize(
           replaced_percentage_resolution_size.block_size;
     }
   } else {
-    AdjustInlineSizeIfNeeded(&replaced_percentage_resolution_size.block_size);
-
-    // We don't store the replaced percentage resolution inline size, so we need
-    // it to be the same as the regular percentage resolution inline size.
-    DCHECK_EQ(replaced_percentage_resolution_size.block_size,
-              space_.PercentageResolutionInlineSize());
+    // There should be no need to handle quirky percentage block-size resolution
+    // if this is an orthogonal writing mode root. The quirky percentage
+    // block-size resolution size that may have been calculated on an ancestor
+    // will be used to resolve inline-sizes of the child, and will therefore now
+    // be lost (since we don't store the quirky replaced percentage resolution
+    // *inline* size, only the *block* size). Just copy whatever was set as a
+    // regular percentage resolution block-size.
+    LayoutUnit block_size = space_.PercentageResolutionBlockSize();
 
     space_.bitfields_.replaced_percentage_block_storage =
-        GetPercentageStorage(replaced_percentage_resolution_size.inline_size,
-                             space_.available_size_.block_size);
+        GetPercentageStorage(block_size, space_.available_size_.block_size);
     if (space_.bitfields_.replaced_percentage_block_storage ==
         kRareDataPercentage) {
       space_.EnsureRareData()->replaced_percentage_resolution_block_size =
-          replaced_percentage_resolution_size.inline_size;
+          block_size;
     }
   }
 

third_party/blink/renderer/core/layout/ng/ng_constraint_space_builder.h

@@ -83,9 +83,22 @@ class CORE_EXPORT NGConstraintSpaceBuilder final {
     return *this;
   }
 
+  // Set percentage resolution size. Prior to calling this method,
+  // SetAvailableSize() must have been called, since we'll compare the input
+  // against the available size set, because if they are equal in either
+  // dimension, we won't have to store the values separately.
   NGConstraintSpaceBuilder& SetPercentageResolutionSize(
       LogicalSize percentage_resolution_size);
 
+  // Set percentage resolution size for replaced content (a special quirk inside
+  // tables). Only honored if the writing modes (container vs. child) are
+  // parallel. In orthogonal writing modes, we'll use whatever regular
+  // percentage resolution size is already set. Prior to calling this method,
+  // SetAvailableSize() must have been called, since we'll compare the input
+  // against the available size set, because if they are equal in either
+  // dimension, we won't have to store the values separately. Additionally,
+  // SetPercentageResolutionSize() must have been called, since we'll override
+  // with that value on orthogonal writing mode roots.
   NGConstraintSpaceBuilder& SetReplacedPercentageResolutionSize(
       LogicalSize replaced_percentage_resolution_size);
 
@@ -313,6 +326,7 @@ class CORE_EXPORT NGConstraintSpaceBuilder final {
 
 #if DCHECK_IS_ON()
   bool is_available_size_set_ = false;
+  bool is_percentage_resolution_size_set_ = false;
   bool is_fragmentainer_block_size_set_ = false;
   bool is_fragmentainer_space_at_bfc_start_set_ = false;
   bool is_block_direction_fragmentation_type_set_ = false;

third_party/blink/web_tests/external/wpt/quirks/table-replaced-descendant-percentage-height-crash.html

+<!-- quirks mode -->
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://github.com/whatwg/quirks/issues/46">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=967069">
+<div style="display:table-cell; height:10000px;">
+  <div style="writing-mode:vertical-rl;">
+    <iframe style="height:100%;"></iframe>
+  </div>
+</div>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+  test(()=> { }, "No crash");
+</script>