Fix getComputedStyle for non-box-layout elements

third_party/WebKit/Source/core/css/ComputedStyleCSSValueMapping.cpp

Index: third_party/WebKit/Source/core/css/ComputedStyleCSSValueMapping.cpp
diff --git a/third_party/WebKit/Source/core/css/ComputedStyleCSSValueMapping.cpp b/third_party/WebKit/Source/core/css/ComputedStyleCSSValueMapping.cpp
index f0fb3cf80a337606b58d189a656e63a7acaf3002..43bc3d3c04ae7d32046aa1a96bdfedff5e868c34 100644
--- a/third_party/WebKit/Source/core/css/ComputedStyleCSSValueMapping.cpp
+++ b/third_party/WebKit/Source/core/css/ComputedStyleCSSValueMapping.cpp
@@ -207,17 +207,19 @@ static CSSValue* valueForPositionOffset(const ComputedStyle& style, CSSPropertyI
             if (opposite.isAuto())
                 return CSSPrimitiveValue::create(0, CSSPrimitiveValue::UnitType::Pixels);
 
-            if (opposite.hasPercent()) {
+            if (opposite.hasPercent() && layoutObject->isBox()) {
                 LayoutUnit containingBlockSize =
                     (propertyID == CSSPropertyLeft || propertyID == CSSPropertyRight) ?
                     toLayoutBox(layoutObject)->containingBlockLogicalWidthForContent() :
                     toLayoutBox(layoutObject)->containingBlockLogicalHeightForGetComputedStyle();
                 return zoomAdjustedPixelValue(-floatValueForLength(opposite, containingBlockSize), style);
             }
-            return zoomAdjustedPixelValue(-opposite.pixels(), style);
+            // Length doesn't provide operator -, so multiply by -1.
+            opposite *= -1.f;

[Timothy Loh, 2016/06/28 00:20:29]

This looks like it might hit an ASSERT if the value is something like calc(1px +
2%)?

[Mr. Kevin, 2016/06/28 00:55:52]

Good catch.  I'll see what I can come up with.

+            return zoomAdjustedPixelValueForLength(opposite, style);
         }
 
-        if (layoutObject->isOutOfFlowPositioned()) {
+        if (layoutObject->isOutOfFlowPositioned() && layoutObject->isBox()) {
             // For fixed and absolute positioned elements, the top, left, bottom, and right
             // are defined relative to the corresponding sides of the containing block.
             LayoutBlock* container = layoutObject->containingBlock();