[css-flex] Fix percentage inline size for column wrap sizing

column wrap flexboxes were giving anonymous items an indefinite percentage inline size during layout-during-intrinsic sizing. When those anonymous items themselves had %-width children, those children were getting an indefinite width during layout, which causes crashes and is generally bad. (cherry picked from commit a3e7f1f) Fixed: 1449346,1459380 Change-Id: I7bf9880fb6b05def0fb2cefcaa766c59e845d5f9 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4663919 Reviewed-by: Ian Kilpatrick <ikilpatrick@chromium.org> Commit-Queue: David Grogan <dgrogan@chromium.org> Cr-Original-Commit-Position: refs/heads/main@{#1166875} Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4676283 Auto-Submit: David Grogan <dgrogan@chromium.org> Commit-Queue: Ian Kilpatrick <ikilpatrick@chromium.org> Reviewed-by: David Grogan <dgrogan@chromium.org> Cr-Commit-Position: refs/branch-heads/5845@{#406} Cr-Branched-From: 5a5dff6-refs/heads/main@{#1160321}
chromium · Jul 10, 2023 · 6ba004d · 6ba004d
1 parent 14c6884
commit 6ba004d
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 6 deletions.
diff --git a/third_party/blink/renderer/core/layout/ng/ng_length_utils.cc b/third_party/blink/renderer/core/layout/ng/ng_length_utils.cc
@@ -1595,9 +1595,11 @@ LogicalSize CalculateChildPercentageSize(
     const NGConstraintSpace& space,
     const NGBlockNode node,
     const LogicalSize child_available_size) {
-  // Anonymous block or spaces should pass the percent size straight through.
-  if (space.IsAnonymous() || node.IsAnonymousBlock())
-    return space.PercentageResolutionSize();
+  // Anonymous block or spaces should use the parent percent block-size.
+  if (space.IsAnonymous() || node.IsAnonymousBlock()) {
+    return {child_available_size.inline_size,
+            space.PercentageResolutionBlockSize()};
+  }
 
   // Table cell children don't apply the "percentage-quirk". I.e. if their
   // percentage resolution block-size is indefinite, they don't pass through
@@ -1615,9 +1617,11 @@ LogicalSize CalculateReplacedChildPercentageSize(
     const LogicalSize child_available_size,
     const NGBoxStrut& border_scrollbar_padding,
     const NGBoxStrut& border_padding) {
-  // Anonymous block or spaces should pass the percent size straight through.
-  if (space.IsAnonymous() || node.IsAnonymousBlock())
-    return space.ReplacedPercentageResolutionSize();
+  // Anonymous block or spaces should use the parent percent block-size.
+  if (space.IsAnonymous() || node.IsAnonymousBlock()) {
+    return {child_available_size.inline_size,
+            space.PercentageResolutionBlockSize()};
+  }
 
   // Table cell children don't apply the "percentage-quirk". I.e. if their
   // percentage resolution block-size is indefinite, they don't pass through

diff --git a/third_party/blink/web_tests/external/wpt/css/css-flexbox/button-column-wrap-crash.html b/third_party/blink/web_tests/external/wpt/css/css-flexbox/button-column-wrap-crash.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+
+<button style="flex-flow: column wrap;">
+  <div style="width: 20%;">
+    <div style="display: flow-root; min-width: 10px;">