Skip to content

GitLab

T
tangled
Commit ae9163bc authored by Koji Ishii's avatar Koji Ishii Committed by Commit Bot
Browse files
Options

Fix |LayoutNGBlockFlowMixin::InlineBlockBaseline| 

r824961 crrev.com/c/2515933 copied the code from |LayoutBlock|
but the code in |LayoutBlockFlow| that prevents it from
running when |ChildrenInline| was not copied. This patch adds
the check.

Note, the test creates |LayoutNGCustom| in legacy, and adds a
|LayoutTextFragment| as a child of the |LayoutNGCustom|. Not
to blockify the child is likely an issue in |LayoutNGCustom|,
but this case could probably be reproduced by inline custom
layout or other inline objects that forces NG.

Bug: 1146789
Change-Id: I7ffacc2465ad205d13702dfda03433cc50c423f9
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2526702
Commit-Queue: Koji Ishii <kojii@chromium.org>
Reviewed-by: default avatarMorten Stenshorne <mstensho@chromium.org>
Reviewed-by: default avatarYoshifumi Inoue <yosin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#825714}
parent 75334d9b
Hide whitespace changes
Inline Side-by-side
Showing with 22 additions and 7 deletions
third_party/blink/renderer/core/layout/ng/layout_ng_block_flow_mixin.cc
View file @ ae9163bc
...@@ -176,13 +176,16 @@ LayoutUnit LayoutNGBlockFlowMixin<Base>::InlineBlockBaseline( ...@@ -176,13 +176,16 @@ LayoutUnit LayoutNGBlockFlowMixin<Base>::InlineBlockBaseline(
return *offset; return *offset;
} }
// This logic is in |LayoutBlock|, but we cannot call |Base| because doing so // This logic is in |LayoutBlock| and |LayoutBlockFlow|, but we cannot call
// may traverse |LayoutObject| tree, which may call this function for a child, // |Base| because doing so may traverse |LayoutObject| tree, which may call
// but the child may be block fragmented. // this function for a child, but the child may be block fragmented.
for (LayoutBox* child = Base::LastChildBox(); child; if (!Base::ChildrenInline()) {
child = child->PreviousSiblingBox()) { for (LayoutObject* child = Base::LastChild(); child;
if (!child->IsFloatingOrOutOfFlowPositioned()) child = child->PreviousSibling()) {
return LayoutUnit(-1); DCHECK(child->IsBox());
if (!child->IsFloatingOrOutOfFlowPositioned())
return LayoutUnit(-1);
}
} }
return Base::EmptyLineBaseline(line_direction); return Base::EmptyLineBaseline(line_direction);
} }
......
third_party/blink/web_tests/external/wpt/css/CSS2/linebox/crashtests/inline-block-baseline-crash.html 0 → 100644
View file @ ae9163bc
<!DOCTYPE html>
<link rel="help" href="https://drafts.csswg.org/css2/#propdef-vertical-align">
<link rel="author" title="Koji Ishii" href="mailto:kojii@chromium.org">
<style>
div::after {
display: layout(parent);
content: "";
}
</style>
<body style="columns: 2">
<div style="display: inline-block"></div>
</body>
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment