Only disable further fragmentation if fragmentation is on.

With the new call to DisableFurtherFragmentation() in NGOutOfFlowLayoutPart::GenerateFragment(), we might attempt to disable fragmentation even if we weren't participating in block fragmentation (a monolithic OOF, for instance). This would lead to a crash if the constraint space didn't have a rare-data object. (cherry picked from commit b06d93b) Bug: 1403467 Change-Id: Icd2e005440f93263511ff68949d40672d4030dd9 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4127783 Reviewed-by: Ian Kilpatrick <ikilpatrick@chromium.org> Commit-Queue: Morten Stenshorne <mstensho@chromium.org> Cr-Original-Commit-Position: refs/heads/main@{#1088065} Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4133345 Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Auto-Submit: Morten Stenshorne <mstensho@chromium.org> Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Cr-Commit-Position: refs/branch-heads/5481@{#111} Cr-Branched-From: 130f3e4-refs/heads/main@{#1084008}
chromium · Jan 3, 2023 · 404cb94 · 404cb94
1 parent fdda60a
commit 404cb94
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 0 deletions.
diff --git a/third_party/blink/renderer/core/layout/ng/ng_constraint_space.h b/third_party/blink/renderer/core/layout/ng/ng_constraint_space.h
@@ -1676,6 +1676,9 @@ class CORE_EXPORT NGConstraintSpace final {
   }
 
   void DisableFurtherFragmentation() {
+    if (!HasBlockFragmentation()) {
+      return;
+    }
     DCHECK(rare_data_);
     rare_data_->block_direction_fragmentation_type = kFragmentNone;
     rare_data_->is_block_fragmentation_forced_off = true;

diff --git a/...b_tests/external/wpt/css/css-multicol/crashtests/monolithic-oof-in-clipped-container.html b/...b_tests/external/wpt/css/css-multicol/crashtests/monolithic-oof-in-clipped-container.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1403467">
+<div style="columns:2; column-fill:auto; height:250px;">
+  <div style="position:relative; overflow:clip; width:100px; height:100px;">
+    <div style="position:absolute; contain:size; width:100px; height:100px;"></div>
+  </div>
+</div>