*ing in title, sorry :), demo: https://output.jsbin.com/nuleve

Able to reproduce the issue on windows 7, Linux Ubuntu 14.04 and Mac 10.11.3 using chrome version 49.0.2623.87 and canary 51.0.2688.0.This is regression issue broken in M36.Please find the bisect information as below.
Narrow Bisect::
Good: 36.0.1948.0  -- (official build 264758)
Bad::36.0.1950.0   --  (official build 264960)


CHANGELOG URL:  https://chromium.googlesource.com/chromium/src/+log/d9d942358cb7031681fa8a10924d69e308243e65..f0e87a679aa6d8643079250b90c9865c2b585aa6

Blink CL :: 
https://build.chromium.org/f/chromium/perf/dashboard/ui/changelog_blink.html?url=%2Ftrunk&range=171870%3A171922&mode=html

the above tool Blink CL is giving blank page.Hence providing omahaproxy Blink CL
Omahaproxy Blink CL:
https://chromium.googlesource.com/chromium/blink/+log/d659a2d8aa5ecbb8f535d2b9bdc346257f9e5cd2..181ff5dcbf6852fac235233f63c936a2ff7be9ff?pretty=fuller&n=10000

Possible suspect from the above Omahaproxy Blink CL
https://codereview.chromium.org/237823002

leviw@ could you please look into this issue if it is related to your change,else please help us in finding the appropriate owner for this issue.

Thanks,

Moving to layout since object-fit and incorrect positioning are usually layout things.

The flexbox spec is fairly specific about sizing, and does not mention object-fit. But I'll email the w3c...

Wait, that's not right, object-fit is not related to this at all.

This is some kind of aspect-ratio issue, which is weird since I thought we handled those correctly...

Sooo, here's the issue. We use this for the height, basically:

    LayoutUnit childIntrinsicContentLogicalHeight = child.intrinsicContentLogicalHeight();

for a replaced element, that is:
    virtual LayoutUnit intrinsicContentLogicalHeight() const { return intrinsicLogicalHeight(); }


which is:
    LayoutUnit intrinsicLogicalHeight() const { return style()->isHorizontalWritingMode() ? intrinsicSize().height() : intrinsicSize().width(); }

Which takes no aspect ratio into account :(

This issue has been Available for over a year. If it's no longer important or seems unlikely to be fixed, please consider closing it out. If it is important, please re-triage the issue.

Sorry for the inconvenience if the bug really should have been left as Available. If you change it back, also remove the "Hotlist-Recharge-Cold" label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot