[layoutng] UpdateOutOfFlowBlockLayout should only lay out itself

This should avoid some double-layouts, and as a side-effect (the original
motivation) it also makes sure that we mark any descendants we find for
UseOldOutOfFlowPositioning(), which fixes a number of DCHECK(!NeedsLayout) failures.
That works through the result->OutOfFlowPositionedDescendants() loop in
LayoutNGBlockFlow::UpdateOutOfFlowBlockLayout.

Bug: 849839
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_layout_tests_layout_ng
Change-Id: If885b16cedaa01b65f7fe2548e42a48c5d3a8a0d
Reviewed-on: https://chromium-review.googlesource.com/1089652Reviewed-by: Aleks Totic <atotic@chromium.org>
Commit-Queue: Christian Biesinger <cbiesinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#565103}

third_party/WebKit/LayoutTests/FlagExpectations/enable-blink-features=LayoutNG

@@ -429,9 +429,7 @@ crbug.com/591099 fast/block/margin-collapse/webkit-margin-collapse-container.htm
 crbug.com/591099 fast/block/margin-collapse/webkit-margin-collapse-separate-position.html [ Failure ]
 crbug.com/591099 fast/block/margin-collapse/webkit-margin-collapse-siblings.html [ Failure ]
 crbug.com/591099 fast/block/over-constrained-auto-margin.html [ Failure ]
-crbug.com/591099 fast/block/positioning/child-of-fixed-pos-after-movement.html [ Crash ]
 crbug.com/591099 fast/block/positioning/complex-positioned-movement-inline-ancestor.html [ Failure ]
-crbug.com/591099 fast/block/positioning/fixed-in-abs-height-change.html [ Crash ]
 crbug.com/591099 fast/block/positioning/positioned-child-inside-relative-positioned-anonymous-block.html [ Failure ]
 crbug.com/591099 fast/block/positioning/relative-overflow-replaced.html [ Failure ]
 crbug.com/591099 fast/borders/bidi-002.html [ Failure ]
@@ -628,7 +626,6 @@ crbug.com/591099 fast/replaced/preferred-widths.html [ Failure ]
 crbug.com/591099 fast/replaced/table-replaced-element.html [ Failure ]
 crbug.com/591099 fast/ruby/position-after.html [ Failure ]
 crbug.com/591099 fast/scrolling/content-box-smaller-than-scrollbar.html [ Failure ]
-crbug.com/591099 fast/scrolling/fractional-scroll-offset-fixed-position-non-composited.html [ Crash ]
 crbug.com/591099 fast/scrolling/jquery-rtl-scroll-type.html [ Failure ]
 crbug.com/591099 fast/scrolling/scrollable-area-frame-overflow-hidden.html [ Failure ]
 crbug.com/591099 fast/scrolling/scrollbar-tickmarks-hittest.html [ Pass ]
@@ -740,7 +737,7 @@ crbug.com/591099 http/tests/loading/preload-picture-nested.html [ Failure ]
 crbug.com/591099 http/tests/loading/preload-picture-sizes-2x.html [ Failure ]
 crbug.com/591099 http/tests/loading/preload-picture-sizes.html [ Failure ]
 crbug.com/591099 http/tests/local/fileapi/select-dragged-file-input.html [ Skip ]
-crbug.com/591099 http/tests/misc/acid3.html [ Crash ]
+crbug.com/591099 http/tests/misc/acid3.html [ Failure ]
 crbug.com/591099 http/tests/misc/object-embedding-svg-delayed-size-negotiation.xhtml [ Failure ]
 crbug.com/591099 http/tests/navigation/form-targets-cross-site-frame-get.html [ Failure ]
 crbug.com/591099 http/tests/navigation/form-targets-cross-site-frame-no-referrer.html [ Failure ]
@@ -903,8 +900,6 @@ crbug.com/591099 paint/invalidation/remove-inline-after-layout.html [ Failure ]
 crbug.com/591099 paint/invalidation/remove-inline-layer-after-layout.html [ Crash ]
 crbug.com/591099 paint/invalidation/repaint-across-writing-mode-boundary.html [ Failure ]
 crbug.com/591099 paint/invalidation/repaint-descandant-on-ancestor-layer-move.html [ Failure ]
-crbug.com/591099 paint/invalidation/scroll/fixed-under-composited-absolute-scrolled.html [ Crash ]
-crbug.com/591099 paint/invalidation/scroll/fixed-with-border-under-composited-absolute-scrolled.html [ Crash ]
 crbug.com/591099 paint/invalidation/scroll/invalidate-after-composited-scroll-of-window.html [ Failure ]
 crbug.com/591099 paint/invalidation/scroll/line-in-scrolled-clipped-block.html [ Failure ]
 crbug.com/591099 paint/invalidation/scroll/resize-scrollable-iframe.html [ Failure ]

third_party/blink/renderer/core/layout/ng/layout_ng_block_flow.cc

@@ -202,11 +202,15 @@ void LayoutNGBlockFlow::UpdateOutOfFlowBlockLayout() {
   if (css_container->IsBox())
     scrollbar_sizes =
         NGBlockNode(ToLayoutBox(css_container)).GetScrollbarSizes();
+  // We really only want to lay out ourselves here, so we pass |this| to
+  // Run(). Otherwise, NGOutOfFlowLayoutPart may also lay out other objects
+  // it discovers that are part of the same containing block, but those
+  // should get laid out by the actual containing block.
   NGOutOfFlowLayoutPart(&container_builder,
                         css_container->CanContainAbsolutePositionObjects(),
                         css_container->CanContainFixedPositionObjects(),
                         scrollbar_sizes, *constraint_space, *container_style)
-      .Run(/* update_legacy */ false);
+      .Run(/* only_layout */ this);
   scoped_refptr<NGLayoutResult> result = container_builder.ToBoxFragment();
   // These are the unpositioned OOF descendants of the current OOF block.
   for (NGOutOfFlowPositionedDescendant descendant :

third_party/blink/renderer/core/layout/ng/ng_out_of_flow_layout_part.cc

@@ -49,7 +49,7 @@ NGOutOfFlowLayoutPart::NGOutOfFlowLayoutPart(
       NGPhysicalOffset(physical_borders.left, physical_borders.top);
 }
 
-void NGOutOfFlowLayoutPart::Run(bool update_legacy) {
+void NGOutOfFlowLayoutPart::Run(LayoutObject* only_layout) {
   Vector<NGOutOfFlowPositionedDescendant> descendant_candidates;
   container_builder_->GetAndClearOutOfFlowDescendantCandidates(
       &descendant_candidates, container_builder_->GetLayoutObject());
@@ -57,12 +57,13 @@ void NGOutOfFlowLayoutPart::Run(bool update_legacy) {
   while (descendant_candidates.size() > 0) {
     ComputeInlineContainingBlocks(descendant_candidates);
     for (auto& candidate : descendant_candidates) {
-      if (IsContainingBlockForDescendant(candidate)) {
+      if (IsContainingBlockForDescendant(candidate) &&
+          (!only_layout || candidate.node.GetLayoutObject() == only_layout)) {
         NGLogicalOffset offset;
         scoped_refptr<NGLayoutResult> result =
             LayoutDescendant(candidate, &offset);
         container_builder_->AddChild(std::move(result), offset);
-        if (update_legacy)
+        if (candidate.node.GetLayoutObject() != only_layout)
           candidate.node.UseOldOutOfFlowPositioning();
       } else {
         container_builder_->AddOutOfFlowDescendant(candidate);

third_party/blink/renderer/core/layout/ng/ng_out_of_flow_layout_part.h

@@ -37,9 +37,13 @@ class CORE_EXPORT NGOutOfFlowLayoutPart {
                         const NGConstraintSpace& container_space,
                         const ComputedStyle& container_style);
 
-  // update_legacy will place NG OOF descendants into their Legacy container.
-  // It should be false if OOF descendants have already been placed into Legacy.
-  void Run(bool update_legacy = true);
+  // Normally this function lays out and positions all out-of-flow objects
+  // from the container_builder and additional ones it discovers through laying
+  // out those objects. However, if only_layout is specified, only that object
+  // will get laid out; any additional ones will be stored as out-of-flow
+  // descendants in the builder for use via
+  // LayoutResult::OutOfFlowPositionedDescendants.
+  void Run(LayoutObject* only_layout = nullptr);
 
  private:
   // Information needed to position descendant within a containing block.