Fix percentage handling for replaced elements

third_party/WebKit/Source/core/layout/LayoutBox.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2005 Allan Sandfeld Jensen (kde@carewolf.com)
  *           (C) 2005, 2006 Samuel Weinig (sam.weinig@gmail.com)
  * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2013 Adobe Systems Incorporated. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ skipping 2892 matching lines @@
 
     switch (logicalHeight.type()) {
     case Fixed:
         return adjustContentBoxLogicalHeightForBoxSizing(logicalHeight.value());
     case Percent:
     case Calculated:
     {
         LayoutObject* cb = isOutOfFlowPositioned() ? container() : containingBlock();
         while (cb->isAnonymous())
             cb = cb->containingBlock();
-        if (cb->isLayoutBlock())
-            toLayoutBlock(cb)->addPercentHeightDescendant(const_cast<LayoutBox*>(this));
+        LayoutUnit stretchedFlexHeight(-1);
+        if (cb->isLayoutBlock()) {
+            LayoutBlock* block = toLayoutBlock(cb);
+            block->addPercentHeightDescendant(const_cast<LayoutBox*>(this));
+            if (block->isFlexItem())
+                stretchedFlexHeight = toLayoutFlexibleBox(block->parent())->childLogicalHeightForPercentageResolution(*block);
+
+        }
 
         if (cb->isOutOfFlowPositioned() && cb->style()->height().isAuto() && !(cb->style()->top().isAuto() || cb->style()->bottom().isAuto())) {
             ASSERT_WITH_SECURITY_IMPLICATION(cb->isLayoutBlock());
             LayoutBlock* block = toLayoutBlock(cb);
             LogicalExtentComputedValues computedValues;
             block->computeLogicalHeight(block->logicalHeight(), LayoutUnit(), computedValues);
             LayoutUnit newContentHeight = computedValues.m_extent - block->borderAndPaddingLogicalHeight() - block->scrollbarLogicalHeight();
             LayoutUnit newHeight = block->adjustContentBoxLogicalHeightForBoxSizing(newContentHeight);
             return adjustContentBoxLogicalHeightForBoxSizing(valueForLength(logicalHeight, newHeight));
         }
 
         // FIXME: availableLogicalHeight() is wrong if the replaced element's writing-mode is perpendicular to the
         // containing block's writing-mode.
         // https://bugs.webkit.org/show_bug.cgi?id=46496
         LayoutUnit availableHeight;
         if (isOutOfFlowPositioned()) {
             availableHeight = containingBlockLogicalHeightForPositioned(toLayoutBoxModelObject(cb));
+        } else if (stretchedFlexHeight != -1) {
+            availableHeight = stretchedFlexHeight;
         } else {
             availableHeight = containingBlockLogicalHeightForContent(IncludeMarginBorderPadding);
             // It is necessary to use the border-box to match WinIE's broken
             // box model.  This is essential for sizing inside
             // table cells using percentage heights.
             // FIXME: This needs to be made writing-mode-aware. If the cell and image are perpendicular writing-modes, this isn't right.
             // https://bugs.webkit.org/show_bug.cgi?id=46997
             while (cb && !cb->isLayoutView() && (cb->style()->logicalHeight().isAuto() || cb->style()->logicalHeight().hasPercent())) {
                 if (cb->isTableCell()) {
                     // Don't let table cells squeeze percent-height replaced elements
@@ skipping 1936 matching lines @@
         m_rareData->m_snapAreas->remove(&snapArea);
     }
 }
 
 SnapAreaSet* LayoutBox::snapAreas() const
 {
     return m_rareData ? m_rareData->m_snapAreas.get() : nullptr;
 }
 
 } // namespace blink