Bug 1842313 [wpt PR 40931] - [layout] Fix relayout boundary logic., a…

…=testonly

Automatic update from web-platform-tests
[layout] Fix relayout boundary logic.

<div id="a">
  <div id="b">
    <div id="inner"></div>
  </div>
</div>

Where "a" and "b" are potential relayout boundary targets.

Previously it was possible to have the following invalidation logic:
1. "inner" changes - and invalidates layout up to "b".
2. "b" gets added as a relayout boundary.
3. "b" changes its *own* style - and invalidates layout up to "a".
   (note this may disqualify "b" as a relayout boundary).
4. Layout starts at "b" but potentially with the wrong constraints.
5. Layout starts at "a", but doesn't revisit "b" as it is layout clean.

This caused various types of DCHECKs and potentially incorrect layouts.

This patch ensures that we don't relayout as a root if we are marked as
needing layout by our *own* style.

Fixed: 1462742
Fixed: 1454351
Change-Id: I0ff0818ac85844acf5f6ec88ad73db83147ee01e
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4671128
Reviewed-by: David Grogan <dgroganchromium.org>
Commit-Queue: Ian Kilpatrick <ikilpatrickchromium.org>
Cr-Commit-Position: refs/heads/main{#1167704}

--

wpt-commits: 0273b727967d5eab46a6fabc6bd77f87c09a10a5
wpt-pr: 40931

UltraBlame original commit: 4305258e426473067a8d54a06f16713be22f065f

testing/web-platform/tests/css/css-contain/crashtests/contain-nested-relayout-boundary.html

@@ -0,0 +1,115 @@
+<
+!
+DOCTYPE
+html
+>
+<
+div
+style
+=
+"
+position
+:
+relative
+;
+width
+:
+100px
+;
+height
+:
+100px
+;
+overflow
+:
+hidden
+;
+"
+>
+<
+div
+id
+=
+"
+target
+"
+style
+=
+"
+contain
+:
+size
+layout
+;
+"
+>
+<
+canvas
+id
+=
+"
+inner
+"
+width
+=
+"
+0
+"
+>
+<
+/
+canvas
+>
+<
+/
+div
+>
+<
+/
+div
+>
+<
+script
+>
+document
+.
+body
+.
+offsetTop
+;
+document
+.
+getElementById
+(
+'
+inner
+'
+)
+.
+width
+=
+'
+100
+'
+;
+document
+.
+getElementById
+(
+'
+target
+'
+)
+.
+style
+.
+contain
+=
+'
+initial
+'
+;
+<
+/
+script
+>

testing/web-platform/tests/svg/layout/svg-foreign-relayout-001.html

@@ -0,0 +1,204 @@
+<
+!
+DOCTYPE
+html
+>
+<
+link
+rel
+=
+"
+help
+"
+href
+=
+"
+https
+:
+/
+/
+bugs
+.
+chromium
+.
+org
+/
+p
+/
+chromium
+/
+issues
+/
+detail
+?
+id
+=
+1462742
+"
+>
+<
+link
+rel
+=
+"
+match
+"
+href
+=
+"
+.
+.
+/
+.
+.
+/
+css
+/
+reference
+/
+ref
+-
+filled
+-
+green
+-
+100px
+-
+square
+-
+only
+.
+html
+"
+>
+<
+p
+>
+Test
+passes
+if
+there
+is
+a
+filled
+green
+square
+.
+<
+/
+p
+>
+<
+svg
+width
+=
+100
+height
+=
+100
+>
+<
+foreignObject
+id
+=
+target
+width
+=
+0
+height
+=
+100
+>
+<
+canvas
+id
+=
+inner
+style
+=
+"
+background
+:
+green
+;
+position
+:
+absolute
+;
+width
+:
+100px
+;
+height
+:
+100px
+;
+left
+:
+0
+;
+top
+:
+0
+;
+"
+>
+<
+/
+canvas
+>
+<
+/
+foreignObject
+>
+<
+/
+svg
+>
+<
+script
+>
+document
+.
+body
+.
+offsetTop
+;
+document
+.
+getElementById
+(
+'
+inner
+'
+)
+.
+width
+=
+'
+100
+'
+;
+document
+.
+getElementById
+(
+'
+target
+'
+)
+.
+setAttribute
+(
+'
+width
+'
+'
+100
+'
+)
+;
+<
+/
+script
+>