Flow threads cannot be subtree layout roots.

mstensho · pull[bot] · commit 12262870fb8a · 2023-08-24T20:40:51.000Z
LayoutTableCell::UpdateStyleWritingModeFromRow() has special code that prevents a table cell from becoming a writing-mode root (because the legacy table implementation cannot handle that). As a workaround it attempts to set all the children of the table cell as writing mode roots. This entire mechanism is somewhat broken (the computed value of writing-mode on table cells is modified somewhere (probably the style adjuster), so that if we dynamically insert block children later, they will inherit the incorrect writing mode), so attempting to fix anything at all there seems risky. Instead, just refuse to relayout a flow thread as a subtree root, just like we already do for table parts (including table cells) and grid items. Bug: 1174687 Change-Id: I1df68512965f8f38d56339d8ca6add0c00b76f04 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3468547 Reviewed-by: Philip Rogers <pdr@chromium.org> Commit-Queue: Morten Stenshorne <mstensho@chromium.org> Cr-Commit-Position: refs/heads/main@{#972847}
diff --git a/css/css-multicol/crashtests/table-cell-writing-mode-root.html b/css/css-multicol/crashtests/table-cell-writing-mode-root.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1174687">
+<div style="display:table-cell; writing-mode:vertical-lr; columns:2;">
+  <span id="surprise" style="display:none;">x</span>
+</div>
+<script>
+  document.body.offsetTop;
+  surprise.style.display = "inline";
+</script>
