[TablesNG] Fix DCHECKs when painting rows/sections with absolute children

Painting code assument that:
- all child fragments of a section are rows
- all child fragments of a row are cells

This is not true when row/section is a absolute container.

Modified wpt test to trigger the crash

Change-Id: Ife8102412a2ef3f2d5bae07a6031739759c3c994
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2636881
Commit-Queue: Aleks Totic <atotic@chromium.org>
Reviewed-by: Philip Rogers <pdr@chromium.org>
Reviewed-by: Ian Kilpatrick <ikilpatrick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#845792}

third_party/blink/renderer/core/paint/ng/ng_table_painters.cc

@@ -507,8 +507,11 @@ void NGTableSectionPainter::PaintBoxDecorationBackground(
         !box_decoration_data.ShouldPaintBackground());
   }
   for (const NGLink& child : fragment_.Children()) {
-    DCHECK(child.fragment->IsBox());
-    NGTableRowPainter(To<NGPhysicalBoxFragment>(*child.fragment))
+    const auto& child_fragment = *child;
+    DCHECK(child_fragment.IsBox());
+    if (!child_fragment.IsTableNGRow())
+      continue;
+    NGTableRowPainter(To<NGPhysicalBoxFragment>(child_fragment))
         .PaintTablePartBackgroundIntoCells(
             paint_info, layout_section,
             PhysicalRect(paint_offset, fragment_.Size()), child.offset);
@@ -525,6 +528,8 @@ void NGTableSectionPainter::PaintColumnsBackground(
     const PhysicalRect& columns_paint_rect,
     const NGTableFragmentData::ColumnGeometries& column_geometries) {
   for (const NGLink& row : fragment_.Children()) {
+    if (!row.fragment->IsTableNGRow())
+      continue;
     NGTableRowPainter(To<NGPhysicalBoxFragment>(*row.fragment))
         .PaintColumnsBackground(paint_info, section_offset + row.offset,
                                 columns_paint_rect, column_geometries);
@@ -568,8 +573,12 @@ void NGTableRowPainter::PaintTablePartBackgroundIntoCells(
     const PhysicalOffset& row_offset) {
   for (const NGLink& child : fragment_.Children()) {
     DCHECK(child.fragment->IsBox());
-    DCHECK(child.fragment->GetLayoutObject()->IsTableCell());
-    NGTableCellPainter(To<NGPhysicalBoxFragment>(*child.fragment))
+    DCHECK(child.fragment->GetLayoutObject()->IsTableCell() ||
+           child.fragment->GetLayoutObject()->IsOutOfFlowPositioned());
+    const auto& child_fragment = *child;
+    if (!child_fragment.IsTableNGCell())
+      continue;
+    NGTableCellPainter(To<NGPhysicalBoxFragment>(child_fragment))
         .PaintBackgroundForTablePart(paint_info, table_part,
                                      table_part_paint_rect,
                                      row_offset + child.offset);

third_party/blink/renderer/core/paint/ng/ng_table_painters.h

@@ -5,6 +5,7 @@
 #ifndef THIRD_PARTY_BLINK_RENDERER_CORE_PAINT_NG_NG_TABLE_PAINTERS_H_
 #define THIRD_PARTY_BLINK_RENDERER_CORE_PAINT_NG_NG_TABLE_PAINTERS_H_
 
+#include "third_party/blink/renderer/core/layout/ng/ng_physical_box_fragment.h"
 #include "third_party/blink/renderer/core/layout/ng/table/ng_table_fragment_data.h"
 #include "third_party/blink/renderer/platform/wtf/allocator/allocator.h"
 
@@ -20,7 +21,9 @@ class NGTablePainter {
 
  public:
   explicit NGTablePainter(const NGPhysicalBoxFragment& table_wrapper_fragment)
-      : fragment_(table_wrapper_fragment) {}
+      : fragment_(table_wrapper_fragment) {
+    DCHECK(fragment_.IsTableNG());
+  }
 
   void PaintBoxDecorationBackground(const PaintInfo&,
                                     const PhysicalOffset&,
@@ -40,7 +43,9 @@ class NGTableSectionPainter {
  public:
   explicit NGTableSectionPainter(
       const NGPhysicalBoxFragment& table_section_fragment)
-      : fragment_(table_section_fragment) {}
+      : fragment_(table_section_fragment) {
+    DCHECK(fragment_.IsTableNGSection());
+  }
 
   void PaintBoxDecorationBackground(const PaintInfo&,
                                     const PhysicalOffset&,
@@ -60,7 +65,9 @@ class NGTableRowPainter {
 
  public:
   explicit NGTableRowPainter(const NGPhysicalBoxFragment& table_row_fragment)
-      : fragment_(table_row_fragment) {}
+      : fragment_(table_row_fragment) {
+    DCHECK(fragment_.IsTableNGRow());
+  }
 
   void PaintBoxDecorationBackground(const PaintInfo&,
                                     const PhysicalOffset&,

third_party/blink/web_tests/external/wpt/css/css-position/position-relative-table-tfoot-top-absolute-child.html

@@ -37,7 +37,7 @@ td > div {
 .relative {
   position: relative;
   top: 50px;
-  background-color: green;
+  background-color: white;
 }
 
 .absolute {
@@ -55,7 +55,7 @@ td > div {
         <tr><td><div></div></td></tr>
       </tbody>
       <tfoot class="relative">
-        <tr><td><div class="absolute"></div></td></tr>
+        <tr><td style="width:50px;height:50px"><div class="absolute"></div></td></tr>
       </tfoot>
     </table>
   </div>