blink: fix LayoutObject::OffsetFromContainerInternal

It should only call OffsetFromScrollableContainer() if the supplied LayoutObject is a scroll container. BUG=1134184 TEST=covered by clusterfuzz Change-Id: I1109a8514590882246dfebe46b7340ac654829cd Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2442895Reviewed-by: Ian Kilpatrick <ikilpatrick@chromium.org> Commit-Queue: Scott Violet <sky@chromium.org> Cr-Commit-Position: refs/heads/master@{#813272}

blink: fix LayoutObject::OffsetFromContainerInternal
It should only call OffsetFromScrollableContainer() if the supplied LayoutObject is a scroll container. BUG=1134184 TEST=covered by clusterfuzz Change-Id: I1109a8514590882246dfebe46b7340ac654829cd Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2442895Reviewed-by: Ian Kilpatrick <ikilpatrick@chromium.org> Commit-Queue: Scott Violet <sky@chromium.org> Cr-Commit-Position: refs/heads/master@{#813272}
871334bf · Scott Violet · Commit Bot · d4fe6f2b · 871334bf · 871334bf
Commit 871334bf authored Oct 02, 2020 by Scott Violet Committed by Commit Bot Oct 02, 2020
2 changed files
--- a/third_party/blink/renderer/core/layout/layout_object.cc
+++ b/third_party/blink/renderer/core/layout/layout_object.cc
@@ -3294,7 +3294,7 @@ PhysicalOffset LayoutObject::OffsetFromContainerInternal(
    bool ignore_scroll_offset) const {
  NOT_DESTROYED();
  DCHECK_EQ(o, Container());
-  return o->HasNonVisibleOverflow()
+  return o->IsScrollContainer()
             ? OffsetFromScrollableContainer(o, ignore_scroll_offset)
             : PhysicalOffset();
 }
@@ -3303,7 +3303,7 @@ PhysicalOffset LayoutObject::OffsetFromScrollableContainer(
    const LayoutObject* container,
    bool ignore_scroll_offset) const {
  NOT_DESTROYED();
-  DCHECK(container->HasNonVisibleOverflow());
+  DCHECK(container->IsScrollContainer());
  const LayoutBox* box = ToLayoutBox(container);
  if (!ignore_scroll_offset)
    return -PhysicalOffset(box->ScrolledContentOffset());

--- a/third_party/blink/web_tests/external/wpt/css/css-overflow/overflow-clip-crash.html
+++ b/third_party/blink/web_tests/external/wpt/css/css-overflow/overflow-clip-crash.html
+<!DOCTYPE html>
+<link rel="author" title="Scott Violet" href="mailto:sky@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1134184">
+<style>
+  * { overflow-x: clip }
+</style>
+<p id="child">child</p>
+<script>
+  window.getSelection().selectAllChildren(
+      document.getElementById("child"));
+</script>