Fieldset NG: the content box should be able to be an OOF container

OOF descendants of a fieldset should not be contained by the fieldset
because they should be scrolled together with the fieldset contents.
This CL makes an anonymous fieldset content box an OOF container by
adding |filter: brightness(100%)| or |position: relative| if the
fieldset can contain OOF objects.

We need to add a special handling for OOF descendants of a LEGEND to
FindAncestorByPredicate() because such OOF descendants are contained
by fieldsets in NG fragment trees.  Without this change, we had some
CHECK failures.

Bug: 1153042
Change-Id: I993922cfd373a9e0558bc50edb009680f0f1244a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2569140Reviewed-by: Morten Stenshorne <mstensho@chromium.org>
Commit-Queue: Kent Tamura <tkent@chromium.org>
Cr-Commit-Position: refs/heads/master@{#834169}

third_party/blink/renderer/core/layout/layout_object.cc

@@ -147,6 +147,22 @@ LayoutObject* FindAncestorByPredicate(const LayoutObject* descendant,
       return object;
     if (skip_info)
       skip_info->Update(*object);
+
+    // According to the HTML standard, a rendered legend is a child of a
+    // fieldset. However a rendered legend is a child of an anonymous fieldset
+    // content box in a LayoutObject tree.  NG fragment trees follow the
+    // structure of the standard.
+    //
+    // The following code resolves this inconsistency, and we skip anonymous
+    // fieldset content boxes if |descendant| is in a rendered legend.
+    if (UNLIKELY(object->IsRenderedLegend())) {
+      LayoutObject* legend_parent = object->Parent();
+      if (legend_parent->IsAnonymous()) {
+        if (skip_info)
+          skip_info->Update(*legend_parent);
+        object = legend_parent;
+      }
+    }
   }
   return nullptr;
 }

third_party/blink/renderer/core/layout/ng/layout_ng_fieldset.cc

@@ -113,6 +113,13 @@ void LayoutNGFieldset::UpdateAnonymousChildStyle(
   child_style.SetOverflowX(StyleRef().OverflowX());
   child_style.SetOverflowY(StyleRef().OverflowY());
   child_style.SetUnicodeBidi(StyleRef().GetUnicodeBidi());
+
+  // If the FIELDSET is an OOF container, the anonymous content box should be
+  // an OOF container to steal OOF objects under the FIELDSET.
+  if (CanContainFixedPositionObjects())
+    child_style.SetContain(kContainsPaint);
+  else if (StyleRef().CanContainAbsolutePositionObjects())
+    child_style.SetPosition(EPosition::kRelative);
 }
 
 bool LayoutNGFieldset::IsOfType(LayoutObjectType type) const {

third_party/blink/web_tests/FlagExpectations/disable-layout-ng

@@ -420,6 +420,7 @@ crbug.com/591099 fast/selectors/input-with-selection-pseudo-element.html [ Failu
 crbug.com/591099 fast/writing-mode/flipped-blocks-inline-map-local-to-container.html [ Failure ]
 
 ### external/wpt/html/rendering
+crbug.com/591099 external/wpt/html/rendering/non-replaced-elements/the-fieldset-and-legend-elements/fieldset-containing-block.html [ Failure ]
 crbug.com/591099 external/wpt/html/rendering/non-replaced-elements/the-fieldset-and-legend-elements/fieldset-overflow-hidden.html [ Failure ]
 crbug.com/591099 external/wpt/html/rendering/non-replaced-elements/the-fieldset-and-legend-elements/fieldset-overflow.html [ Crash Failure ]
 crbug.com/591099 external/wpt/html/rendering/non-replaced-elements/the-fieldset-and-legend-elements/fieldset-vertical.html [ Failure ]

third_party/blink/web_tests/TestExpectations

@@ -2957,7 +2957,6 @@ crbug.com/626703 external/wpt/css/selectors/old-tests/css3-modsel-65.xml [ Skip
 crbug.com/626703 external/wpt/css/selectors/old-tests/css3-modsel-18b.xml [ Skip ]
 crbug.com/626703 external/wpt/css/selectors/old-tests/css3-modsel-159.xml [ Skip ]
 crbug.com/626703 external/wpt/html/webappapis/dynamic-markup-insertion/opening-the-input-stream/reload.window.html [ Timeout ]
-crbug.com/626703 external/wpt/html/rendering/non-replaced-elements/the-fieldset-and-legend-elements/fieldset-containing-block.html [ Failure ]
 crbug.com/626703 external/wpt/quirks/text-decoration-doesnt-propagate-into-tables/quirks.html [ Failure ]
 crbug.com/626703 external/wpt/html/rendering/non-replaced-elements/the-fieldset-and-legend-elements/fieldset-painting-order.html [ Failure ]
 crbug.com/626703 external/wpt/html/webappapis/dynamic-markup-insertion/opening-the-input-stream/tasks.window.html [ Timeout ]

third_party/blink/web_tests/external/wpt/html/rendering/non-replaced-elements/the-fieldset-and-legend-elements/fieldset-containing-block-ref.html

@@ -2,7 +2,9 @@
 <title>Reference for fieldset containing block</title>
 <style>
 p { margin: 0; height: 100px }
-div { position: absolute; top: 108px; width: 100px; height: 100px; background: lime; }
+.div1 { position: absolute; top: 108px; width: 100px; height: 100px; background: lime; }
+.div2 { position: absolute; top: 158px; width: 200px; height: 100px; background: lime; }
 </style>
 <p>There should be no red.</p>
-<div></div>
+<div class="div1"></div>
+<div class="div2"></div>

third_party/blink/web_tests/external/wpt/html/rendering/non-replaced-elements/the-fieldset-and-legend-elements/fieldset-containing-block.html

@@ -7,7 +7,29 @@ fieldset { position: relative; border: none; padding: 0; margin: 0; }
 legend { padding: 0; width: 100px; height: 50px; background: lime; }
 div { position: absolute; top: 0; width: 100px; height: 50px; background: lime; }
 .behind { height:100px; top: 108px; background: red; }
+
+.fixed-container {
+  filter: invert();
+  overflow: hidden;
+  width: 200px;
+  height: 200px;
+}
+.fixed {
+  position: fixed;
+  width: 400px;
+  height: 100px;
+  background: linear-gradient(to right, #ff00ff 50%, #00ffff 50%);
+}
+.has-fixed {
+  width: 0px;
+  height: 0px;
+}
 </style>
 <p>There should be no red.</p>
 <div class="behind"></div>
 <fieldset><legend></legend><div></div></fieldset>
+
+<fieldset class="fixed-container">
+<legend class="has-fixed"><div style="position:fixed; width:0; height0;"></div></legend>
+<div class="fixed"></div>
+</fieldset>