From ecc4718745a402e4a6fb4c44ca4e58c7233a4cef Mon Sep 17 00:00:00 2001
From: Marco Castelluccio <mcastelluccio@mozilla.com>
Date: Fri, 21 Jul 2023 19:18:54 +0000
Subject: [PATCH] Bug 1842313 [wpt PR 40931] - [layout] Fix relayout boundary
 logic., a=testonly

Automatic update from web-platform-tests
[layout] Fix relayout boundary logic.

<div id="a">
  <div id="b">
    <div id="inner"></div>
  </div>
</div>

Where "a" and "b" are potential relayout boundary targets.

Previously it was possible to have the following invalidation logic:
1. "inner" changes - and invalidates layout up to "b".
2. "b" gets added as a relayout boundary.
3. "b" changes its *own* style - and invalidates layout up to "a".
   (note this may disqualify "b" as a relayout boundary).
4. Layout starts at "b" but potentially with the wrong constraints.
5. Layout starts at "a", but doesn't revisit "b" as it is layout clean.

This caused various types of DCHECKs and potentially incorrect layouts.

This patch ensures that we don't relayout as a root if we are marked as
needing layout by our *own* style.

Fixed: 1462742
Fixed: 1454351
Change-Id: I0ff0818ac85844acf5f6ec88ad73db83147ee01e
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4671128
Reviewed-by: David Grogan <dgroganchromium.org>
Commit-Queue: Ian Kilpatrick <ikilpatrickchromium.org>
Cr-Commit-Position: refs/heads/main{#1167704}

--

wpt-commits: 0273b727967d5eab46a6fabc6bd77f87c09a10a5
wpt-pr: 40931

UltraBlame original commit: 4305258e426473067a8d54a06f16713be22f065f
---
 .../contain-nested-relayout-boundary.html     | 115 ++++++++++
 .../svg/layout/svg-foreign-relayout-001.html  | 204 +++++++++++++++++
 .../svg/layout/svg-foreign-relayout-002.html  | 207 ++++++++++++++++++
 3 files changed, 526 insertions(+)
 create mode 100644 testing/web-platform/tests/css/css-contain/crashtests/contain-nested-relayout-boundary.html
 create mode 100644 testing/web-platform/tests/svg/layout/svg-foreign-relayout-001.html
 create mode 100644 testing/web-platform/tests/svg/layout/svg-foreign-relayout-002.html

diff --git a/testing/web-platform/tests/css/css-contain/crashtests/contain-nested-relayout-boundary.html b/testing/web-platform/tests/css/css-contain/crashtests/contain-nested-relayout-boundary.html
new file mode 100644
index 000000000000..d41ddb585084
--- /dev/null
+++ b/testing/web-platform/tests/css/css-contain/crashtests/contain-nested-relayout-boundary.html
@@ -0,0 +1,115 @@
+<
+!
+DOCTYPE
+html
+>
+<
+div
+style
+=
+"
+position
+:
+relative
+;
+width
+:
+100px
+;
+height
+:
+100px
+;
+overflow
+:
+hidden
+;
+"
+>
+<
+div
+id
+=
+"
+target
+"
+style
+=
+"
+contain
+:
+size
+layout
+;
+"
+>
+<
+canvas
+id
+=
+"
+inner
+"
+width
+=
+"
+0
+"
+>
+<
+/
+canvas
+>
+<
+/
+div
+>
+<
+/
+div
+>
+<
+script
+>
+document
+.
+body
+.
+offsetTop
+;
+document
+.
+getElementById
+(
+'
+inner
+'
+)
+.
+width
+=
+'
+100
+'
+;
+document
+.
+getElementById
+(
+'
+target
+'
+)
+.
+style
+.
+contain
+=
+'
+initial
+'
+;
+<
+/
+script
+>
diff --git a/testing/web-platform/tests/svg/layout/svg-foreign-relayout-001.html b/testing/web-platform/tests/svg/layout/svg-foreign-relayout-001.html
new file mode 100644
index 000000000000..2a8fd3123c09
--- /dev/null
+++ b/testing/web-platform/tests/svg/layout/svg-foreign-relayout-001.html
@@ -0,0 +1,204 @@
+<
+!
+DOCTYPE
+html
+>
+<
+link
+rel
+=
+"
+help
+"
+href
+=
+"
+https
+:
+/
+/
+bugs
+.
+chromium
+.
+org
+/
+p
+/
+chromium
+/
+issues
+/
+detail
+?
+id
+=
+1462742
+"
+>
+<
+link
+rel
+=
+"
+match
+"
+href
+=
+"
+.
+.
+/
+.
+.
+/
+css
+/
+reference
+/
+ref
+-
+filled
+-
+green
+-
+100px
+-
+square
+-
+only
+.
+html
+"
+>
+<
+p
+>
+Test
+passes
+if
+there
+is
+a
+filled
+green
+square
+.
+<
+/
+p
+>
+<
+svg
+width
+=
+100
+height
+=
+100
+>
+<
+foreignObject
+id
+=
+target
+width
+=
+0
+height
+=
+100
+>
+<
+canvas
+id
+=
+inner
+style
+=
+"
+background
+:
+green
+;
+position
+:
+absolute
+;
+width
+:
+100px
+;
+height
+:
+100px
+;
+left
+:
+0
+;
+top
+:
+0
+;
+"
+>
+<
+/
+canvas
+>
+<
+/
+foreignObject
+>
+<
+/
+svg
+>
+<
+script
+>
+document
+.
+body
+.
+offsetTop
+;
+document
+.
+getElementById
+(
+'
+inner
+'
+)
+.
+width
+=
+'
+100
+'
+;
+document
+.
+getElementById
+(
+'
+target
+'
+)
+.
+setAttribute
+(
+'
+width
+'
+'
+100
+'
+)
+;
+<
+/
+script
+>
diff --git a/testing/web-platform/tests/svg/layout/svg-foreign-relayout-002.html b/testing/web-platform/tests/svg/layout/svg-foreign-relayout-002.html
new file mode 100644
index 000000000000..3dc04ec51885
--- /dev/null
+++ b/testing/web-platform/tests/svg/layout/svg-foreign-relayout-002.html
@@ -0,0 +1,207 @@
+<
+!
+DOCTYPE
+html
+>
+<
+link
+rel
+=
+"
+help
+"
+href
+=
+"
+https
+:
+/
+/
+bugs
+.
+chromium
+.
+org
+/
+p
+/
+chromium
+/
+issues
+/
+detail
+?
+id
+=
+1462742
+"
+>
+<
+link
+rel
+=
+"
+match
+"
+href
+=
+"
+.
+.
+/
+.
+.
+/
+css
+/
+reference
+/
+ref
+-
+filled
+-
+green
+-
+100px
+-
+square
+-
+only
+.
+html
+"
+>
+<
+p
+>
+Test
+passes
+if
+there
+is
+a
+filled
+green
+square
+.
+<
+/
+p
+>
+<
+svg
+width
+=
+100
+height
+=
+100
+>
+<
+foreignObject
+id
+=
+target
+x
+=
+100
+width
+=
+100
+height
+=
+100
+>
+<
+canvas
+id
+=
+inner
+style
+=
+"
+background
+:
+green
+;
+position
+:
+absolute
+;
+width
+:
+100px
+;
+height
+:
+100px
+;
+left
+:
+0
+;
+top
+:
+0
+;
+"
+>
+<
+/
+canvas
+>
+<
+/
+foreignObject
+>
+<
+/
+svg
+>
+<
+script
+>
+document
+.
+body
+.
+offsetTop
+;
+document
+.
+getElementById
+(
+'
+inner
+'
+)
+.
+width
+=
+'
+100
+'
+;
+document
+.
+getElementById
+(
+'
+target
+'
+)
+.
+setAttribute
+(
+'
+x
+'
+'
+0
+'
+)
+;
+<
+/
+script
+>