[layout] Fix table crash due to invalid intrinsic size cache.

https://chromium.googlesource.com/chromium/src/+/d8154ef080c5814125dd49c64442e5c55892c886 ... introduced some logic to try and hit the intrinsic sizes cache more often by checking of the %-padding resolution size was indefinite. This was incorrect. Effectively if one pass *had* a valid %-padding size, we'd skip the cache, calculate the intrinsic-sizes, and store it in the cache. However we wouldn't store *what* the %-padding resolved against. In the next pass (making the %-padding resolve against kIndefiniteSize) we'd hit the cache due to these two lines, resulting in an incorrect answer. The correct way of doing this optimization would have been to store the %-padding resolution size. Bug: 1195685 Change-Id: I3533d8764504cfe9bf367579b8f63d63ea997136 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2806100 Reviewed-by: Christian Biesinger <cbiesinger@chromium.org> Commit-Queue: Ian Kilpatrick <ikilpatrick@chromium.org> Cr-Commit-Position: refs/heads/master@{#869289}
chromium · Apr 5, 2021 · bfeac9e · bfeac9e
1 parent 18275d3
commit bfeac9e
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 5 deletions.
diff --git a/third_party/blink/renderer/core/layout/ng/ng_block_node.cc b/third_party/blink/renderer/core/layout/ng/ng_block_node.cc
@@ -297,11 +297,8 @@ bool CanUseCachedIntrinsicInlineSizes(const NGConstraintSpace& constraint_space,
 
   // Check if we have any percentage inline padding.
   const auto& style = node.Style();
-  if (style.MayHavePadding() &&
-      (style.PaddingStart().IsPercentOrCalc() ||
-       style.PaddingEnd().IsPercentOrCalc()) &&
-      constraint_space.PercentageResolutionInlineSizeForParentWritingMode() !=
-          kIndefiniteSize)
+  if (style.MayHavePadding() && (style.PaddingStart().IsPercentOrCalc() ||
+                                 style.PaddingEnd().IsPercentOrCalc()))
     return false;
 
   if (!style.AspectRatio().IsAuto() &&

diff --git a/...blink/web_tests/external/wpt/css/css-tables/crashtests/textarea-intrinsic-size-crash.html b/...blink/web_tests/external/wpt/css/css-tables/crashtests/textarea-intrinsic-size-crash.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1195685">
+<div style="display: -webkit-box;">
+  <div style="display: table-cell;">
+    <textarea style="padding-left: 556658635%;">
+      x