layout: Ensure compatible positioning context during flexbox block content sizing calculation (#36123)

Sometimes column Flexbox needs to do an early layout pass to determine
the preferred block content size of flex items. Previously the
absolutely positioned children created during this pass were discarded,
but now they are cached to be possibly used during the final layout
phase of the flex item. Since they are not thrown away, it is necessary
that the `PositioningContext` used to collect them is compatible with
their final `PositioningContext`.

Fixes #36121.

Signed-off-by: Martin Robinson <mrobinson@igalia.com>
This commit is contained in:
Martin Robinson 2025-03-25 10:41:59 +01:00 committed by GitHub
parent b79a79458d
commit b4a768cfc7
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 28 additions and 5 deletions

View file

@ -2619,11 +2619,14 @@ impl FlexItemBox {
auto_cross_size_stretches_to_container_size: bool,
intrinsic_sizing_mode: IntrinsicSizingMode,
) -> Au {
let mut positioning_context = PositioningContext::new_for_subtree(
flex_context
.positioning_context
.collects_for_nearest_positioned_ancestor(),
);
let mut positioning_context = PositioningContext::new_for_style(self.style())
.unwrap_or_else(|| {
PositioningContext::new_for_subtree(
flex_context
.positioning_context
.collects_for_nearest_positioned_ancestor(),
)
});
let style = self.independent_formatting_context.style();
match &self.independent_formatting_context.contents {

View file

@ -2599,6 +2599,13 @@
{}
]
],
"mixed-containing-blocks-crash.html": [
"f8a38e057d32e8bb8d7e143d867ca6364210ba38",
[
null,
{}
]
],
"negative-available-size-crash.html": [
"837fdaeba9ef8baeb4f2bad281bb13551d6d8ff9",
[

View file

@ -0,0 +1,13 @@
<!DOCTYPE html>
<title>CSS Flexbox: Mixed containing blocks</title>
<link rel="help" href="https://drafts.csswg.org/css-flexbox">
<link rel="help" href="https://github.com/servo/servo/issues/36121">
<meta name="assert" content="This test ensures that flex boxes that establish a containing block for fixed position descendants do not cause a crash when combined with flex items that establish a containing block for absolutely positioned descendants.">
<html>
<div class="box" style="display: flex; flex-direction: column; transform: translateX(1px)">
<div style="position: relative;"><div>Three</div><div style="position: absolute">fixed</div></div>
</div>
</div>