[LayoutNG] Percentage top property doesn't contribute to overflow |
||
Issue descriptionThe reason for this bug is that we use legacy layout to calculate overflow and read out size data from NG layout objects that haven't been finished yet, so we end up with size data from the previous layout run (or typically 0 if there's no previous layout run). #4 0x00007fffe211b005 in blink::LayoutBox::AssertSizeKnown (this=0x56d076246a0) at ../../third_party/blink/renderer/core/layout/layout_box.h:1746 #5 0x00007fffe2d176a9 in blink::LayoutBox::ClientHeight (this=0x56d076246a0) at ../../third_party/blink/renderer/core/layout/layout_box.cc:539 #6 0x00007fffe2c66dd5 in blink::LayoutBox::ClientLogicalHeight (this=0x56d076246a0) at ../../third_party/blink/renderer/core/layout/layout_box.h:667 #7 0x00007fffe2d2056b in blink::LayoutBox::ContainingBlockLogicalHeightForPositioned (this=0x56d076242b0, containing_block=0x56d076246a0, check_for_perpendicular_writing_mode=true) at ../../third_party/blink/renderer/core/layout/layout_box.cc:4061 #8 0x00007fffe2d2cd7e in blink::LayoutBox::ComputePositionedLogicalHeight (this=0x56d076242b0, computed_values=...) at ../../third_party/blink/renderer/core/layout/layout_box.cc:4639 #9 0x00007fffe2d263db in blink::LayoutBox::ComputeLogicalHeight (this=0x56d076242b0, logical_height=200px, logical_top=0px, computed_values=...) at ../../third_party/blink/renderer/core/layout/layout_box.cc:3236 #10 0x00007fffe2d2a8c2 in blink::LayoutBox::AvailableLogicalHeightUsing (this=0x56d076242b0, h=Length(Auto), height_type=blink::kIncludeMarginBorderPadding) at ../../third_party/blink/renderer/core/layout/layout_box.cc:3926 #11 0x00007fffe2d2090c in blink::LayoutBox::AvailableLogicalHeight (this=0x56d076242b0, height_type=blink::kIncludeMarginBorderPadding) at ../../third_party/blink/renderer/core/layout/layout_box.cc:3859 #12 0x00007fffe2d43952 in blink::LayoutBox::AvailableHeight (this=0x56d076242b0) at ../../third_party/blink/renderer/core/layout/layout_box.h:1087 #13 0x00007fffe2d3f11c in blink::LayoutBoxModelObject::RelativePositionOffset (this=0x56d07624400) at ../../third_party/blink/renderer/core/layout/layout_box_model_object.cc:823 #14 0x00007fffe2d41195 in blink::LayoutBoxModelObject::OffsetForInFlowPosition (this=0x56d07624400) at ../../third_party/blink/renderer/core/layout/layout_box_model_object.cc:1188 #15 0x00007fffe2d30b83 in blink::LayoutBox::LayoutOverflowRectForPropagation (this=0x56d07624400, container=0x56d076242b0) at ../../third_party/blink/renderer/core/layout/layout_box.cc:5575 #16 0x00007fffe2d3091e in blink::LayoutBox::AddLayoutOverflowFromChild (this=0x56d076242b0, child=..., delta=LayoutSize(0px, 0px)) at ../../third_party/blink/renderer/core/layout/layout_box.cc:5315 #17 0x00007fffe2cd12e1 in blink::LayoutBox::AddLayoutOverflowFromChild (this=0x56d076242b0, child=...) at ../../third_party/blink/renderer/core/layout/layout_box.h:560 #18 0x00007fffe2cc6d15 in blink::LayoutBlock::AddLayoutOverflowFromBlockChildren (this=0x56d076242b0) at ../../third_party/blink/renderer/core/layout/layout_block.cc:593 #19 0x00007fffe2cc6c3e in blink::LayoutBlock::AddLayoutOverflowFromChildren (this=0x56d076242b0) at ../../third_party/blink/renderer/core/layout/layout_block.cc:505 #20 0x00007fffe2ef28d8 in blink::LayoutNGMixin<blink::LayoutTableCaption>::AddLayoutOverflowFromChildren (this=0x56d076242b0) at ../../third_party/blink/renderer/core/layout/ng/layout_ng_mixin.cc:117 #21 0x00007fffe2cc705d in blink::LayoutBlock::ComputeLayoutOverflow (this=0x56d076242b0, old_client_after_edge=100px) at ../../third_party/blink/renderer/core/layout/layout_block.cc:534 #22 0x00007fffe2ceaa7a in blink::LayoutBlockFlow::ComputeLayoutOverflow (this=0x56d076242b0, old_client_after_edge=100px, recompute_floats=false) at ../../third_party/blink/renderer/core/layout/layout_block_flow.cc:2593 #23 0x00007fffe2cc6e51 in blink::LayoutBlock::ComputeOverflow (this=0x56d076242b0, old_client_after_edge=100px, recompute_floats=false) at ../../third_party/blink/renderer/core/layout/layout_block.cc:512 #24 0x00007fffe2f14795 in blink::NGBlockNode::CopyFragmentDataToLayoutBox (this=0x7fffa1839c38, constraint_space=..., layout_result=...) at ../../third_party/blink/renderer/core/layout/ng/ng_block_node.cc:621 #25 0x00007fffe2f13def in blink::NGBlockNode::FinishLayout (this=0x7fffa1839c38, block_flow=0x56d076242b0, constraint_space=..., break_token=0x0, layout_result=...) at ../../third_party/blink/renderer/core/layout/ng/ng_block_node.cc:350 #26 0x00007fffe2f125f0 in blink::NGBlockNode::Layout (this=0x7fffa1839c38, constraint_space=..., break_token=0x0) at ../../third_party/blink/renderer/core/layout/ng/ng_block_node.cc:261 #27 0x00007fffe2f38fe6 in blink::NGOutOfFlowLayoutPart::GenerateFragment (this=0x7fffa183a370, descendant=..., container_info=..., block_estimate=..., node_position=...) at ../../third_party/blink/renderer/core/layout/ng/ng_out_of_flow_layout_part.cc:468 #28 0x00007fffe2f38933 in blink::NGOutOfFlowLayoutPart::LayoutDescendant (this=0x7fffa183a370, descendant=..., offset=0x7fffa183a118) at ../../third_party/blink/renderer/core/layout/ng/ng_out_of_flow_layout_part.cc:385 #29 0x00007fffe2f36db8 in blink::NGOutOfFlowLayoutPart::Run (this=0x7fffa183a370, only_layout=0x0) at ../../third_party/blink/renderer/core/layout/ng/ng_out_of_flow_layout_part.cc:67 I have a local patch that DCHECKs (see frame #4 above) whether it's safe to read out size data from an NG ancestor (which it typically isn't in the middle of layout), and it fails with this testcase. That DCHECK patch causes a lot of failures, and helped me find this bug, among other things.
,
Nov 23
,
Dec 1
Did some investigation on your example. Something looks off to me.
This is the stack:
#0 blink::LayoutBox::ComputeContentAndScrollbarLogicalHeightUsing () at :3405
#1 blink::LayoutBox::AvailableLogicalHeightUsing () at :3879
#2 blink::LayoutBox::AvailableLogicalHeight () at :3827
#3 blink::LayoutBox::AvailableHeight () at :1053
#4 blink::LayoutBoxModelObject::RelativePositionOffset () at :815
#5 blink::LayoutBoxModelObject::OffsetForInFlowPosition () at :1180 LayoutNGBlockFlow (relative positioned) DIV
#6 blink::LayoutBox::LayoutOverflowRectForPropagation () at :5543
#7 blink::LayoutBox::AddLayoutOverflowFromChild () at :5283
#8 blink::LayoutBox::AddLayoutOverflowFromChild () at :537
#9 blink::LayoutBlock::AddLayoutOverflowFromBlockChildren () at :593
#10 blink::LayoutBlock::AddLayoutOverflowFromChildren () at :505
#11 blink::LayoutNGMixin<blink::LayoutTableCaption>::AddLayoutOverflowFromChildr
en () at :117
#12 blink::LayoutBlock::ComputeLayoutOverflow () at :534
blink::LayoutBlockFlow::ComputeLayoutOverflow () at :2593
blink::LayoutBlock::ComputeOverflow () at :512
#15 #? blink::NGBlockNode::CopyFragmentDataToLayoutBox "LayoutNGBlockFlow (posit
ioned) DIV id='container'" () at :595
At this point, #container has width and height.
At this point in the stack, relative DIV is trying to compute its overflow rect.
It resolves its "top" incorrectly, because it is resolving 100% against #container.AvailableHeight
#container.AvailableHeight returns 0 even though its size is 200px.
gdb) p container->FrameRect()
$67 = {
location_ = LayoutPoint(0px, 0px),
size_ = LayoutSize(200px, 200px)
}
I am not familiar with Legacy code enough to determine what is wrong.
But, intuitively, AvailableHeight should be 200px, not 0.
We've already computed it, there should be a way to return correct value.
|
||
►
Sign in to add a comment |
||
Comment 1 by mstensho@chromium.org
, Nov 23