input's placeholder is inconsistently laid out

third_party/WebKit/Source/core/layout/LayoutTextControlSingleLine.cpp

 /**
  * Copyright (C) 2006, 2007, 2010 Apple Inc. All rights reserved.
  *           (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2010 Google Inc. All rights reserved.
  * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 103 matching lines @@
 
     // We don't honor paddings and borders for textfields without decorations
     // and type=search if the text height is taller than the contentHeight()
     // because of compability.
 
     LayoutBox* innerEditorLayoutObject = innerEditorElement()->layoutBox();
     bool innerEditorLayoutObjectHadLayout = innerEditorLayoutObject && innerEditorLayoutObject->needsLayout();
     LayoutBox* viewPortLayoutObject = editingViewPortElement() ? editingViewPortElement()->layoutBox() : 0;
 
     // To ensure consistency between layouts, we need to reset any conditionally overriden height.
-    if (innerEditorLayoutObject && !innerEditorLayoutObject->styleRef().logicalHeight().isAuto()) {
-        innerEditorLayoutObject->mutableStyleRef().setLogicalHeight(Length(Auto));
+    if (innerEditorLayoutObject) {
+        innerEditorLayoutObject->clearOverrideLogicalContentHeight();
+        // TODO(jchaffraix): We could probably skip some of these due to
+        // forcing children relayout below but keeping them for safety for now.
         layoutScope.setNeedsLayout(innerEditorLayoutObject, LayoutInvalidationReason::TextControlChanged);
         HTMLElement* placeholderElement = inputElement()->placeholderElement();
         if (LayoutBox* placeholderBox = placeholderElement ? placeholderElement->layoutBox() : 0)
             layoutScope.setNeedsLayout(placeholderBox, LayoutInvalidationReason::TextControlChanged);
     }
+    // TODO(jchaffraix): This logic is not correct and will yield to bugs such
+    // as crbug.com/529252. The fix is similar to what is done with
+    // innerEditorLayoutObject above.
     if (viewPortLayoutObject && !viewPortLayoutObject->styleRef().logicalHeight().isAuto()) {
         viewPortLayoutObject->mutableStyleRef().setLogicalHeight(Length(Auto));
         layoutScope.setNeedsLayout(viewPortLayoutObject, LayoutInvalidationReason::TextControlChanged);
     }
 
-    LayoutBlockFlow::layoutBlock(false);
+    // This is the measuring phase. Thus we force children to be relayout so
+    // that the checks below are executed consistently.
+    LayoutBlockFlow::layoutBlock(true);
 
     Element* container = containerElement();
     LayoutBox* containerLayoutObject = container ? container->layoutBox() : 0;
 
     // Set the text block height
     LayoutUnit desiredLogicalHeight = textBlockLogicalHeight();
     LayoutUnit logicalHeightLimit = computeLogicalHeightLimit();
     if (innerEditorLayoutObject && innerEditorLayoutObject->logicalHeight() > logicalHeightLimit) {
         if (desiredLogicalHeight != innerEditorLayoutObject->logicalHeight())
             layoutScope.setNeedsLayout(this, LayoutInvalidationReason::TextControlChanged);
 
         m_desiredInnerEditorLogicalHeight = desiredLogicalHeight;
 
-        innerEditorLayoutObject->mutableStyleRef().setLogicalHeight(Length(desiredLogicalHeight, Fixed));
+        innerEditorLayoutObject->setOverrideLogicalContentHeight(desiredLogicalHeight);
         layoutScope.setNeedsLayout(innerEditorLayoutObject, LayoutInvalidationReason::TextControlChanged);
         if (viewPortLayoutObject) {
             viewPortLayoutObject->mutableStyleRef().setLogicalHeight(Length(desiredLogicalHeight, Fixed));
             layoutScope.setNeedsLayout(viewPortLayoutObject, LayoutInvalidationReason::TextControlChanged);
         }
     }
     // The container might be taller because of decoration elements.
     if (containerLayoutObject) {
         containerLayoutObject->layoutIfNeeded();
         LayoutUnit containerLogicalHeight = containerLayoutObject->logicalHeight();
@@ skipping 84 matching lines @@
     Element* viewPort = editingViewPortElement();
     if (LayoutObject* viewPortLayoutObject = viewPort ? viewPort->layoutObject() : 0) {
         viewPortLayoutObject->mutableStyleRef().setHeight(Length());
         viewPortLayoutObject->mutableStyleRef().setWidth(Length());
     }
     Element* container = containerElement();
     if (LayoutObject* containerLayoutObject = container ? container->layoutObject() : 0) {
         containerLayoutObject->mutableStyleRef().setHeight(Length());
         containerLayoutObject->mutableStyleRef().setWidth(Length());
     }
-    LayoutObject* innerEditorLayoutObject = innerEditorElement()->layoutObject();
-    if (innerEditorLayoutObject && diff.needsFullLayout())
-        innerEditorLayoutObject->setNeedsLayoutAndFullPaintInvalidation(LayoutInvalidationReason::StyleChange);
     if (HTMLElement* placeholder = inputElement()->placeholderElement())
         placeholder->setInlineStyleProperty(CSSPropertyTextOverflow, textShouldBeTruncated() ? CSSValueEllipsis : CSSValueClip);
     setHasOverflowClip(false);
 }
 
 void LayoutTextControlSingleLine::capsLockStateMayHaveChanged()
 {
     if (!node())
         return;
 
@@ skipping 177 matching lines @@
     if (innerEditorElement())
         innerEditorElement()->setScrollTop(newTop);
 }
 
 HTMLInputElement* LayoutTextControlSingleLine::inputElement() const
 {
     return toHTMLInputElement(node());
 }
 
 }