Fix LayoutBox::topLeftLocation for table rows and table cells

third_party/WebKit/Source/core/layout/LayoutBox.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2005 Allan Sandfeld Jensen (kde@carewolf.com)
  *           (C) 2005, 2006 Samuel Weinig (sam.weinig@gmail.com)
  * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2013 Adobe Systems Incorporated. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ skipping 2264 matching lines @@
   inflateVisualRectForFilter(rect);
 
   if (ancestor == this)
     return true;
 
   bool ancestorSkipped;
   bool filterSkipped;
   LayoutObject* container =
       this->container(ancestor, &ancestorSkipped, &filterSkipped);
   LayoutBox* tableRowContainer = nullptr;
-  // Skip table row because cells and rows are in the same coordinate space
-  // (see below, however for more comments about when |ancestor| is the table row).
-  // The second and third conditionals below are to skip cases where content has display: table-row or display: table-cell but is not
-  // parented like a cell/row combo.
-  if (container->isTableRow() && isTableCell() && parentBox() == container) {
+  // Skip table row because cells and rows are in the same coordinate space (see
+  // below, however for more comments about when |ancestor| is the table row).
+  if (isTableCell()) {
+    DCHECK(container->isTableRow() && parentBox() == container);

[chrishtr, 2016/10/04 17:32:17]

I changed the code to remove the DCHECK just last week due to the possibility of
elements having display: table-cell. You will need to change the code back.

https://blink.lc/chromium/commit/?id=c92b29db029d52d6423835f13741112867a3c00d

[Xianzhu, 2016/10/04 17:48:02]

Based on my test, we create anonymous LayoutTable, LayoutTableSection and
LayoutTableRow for display: table-cell. Have you encountered exception of this?

     if (container != ancestor)
       container = container->parent();
     else
       tableRowContainer = toLayoutBox(container);
   }
   if (!container)
     return true;
 
   if (filterSkipped)
     inflateVisualRectForFilterUnderContainer(rect, *container, ancestor);
@@ skipping 2740 matching lines @@
   if (!style()->isFlippedBlocksWritingMode())
     return point;
 
   // The child is going to add in its x(), so we have to make sure it ends up in
   // the right place.
   return LayoutPoint(point.x() + size().width() - child->size().width() -
                          (2 * child->location().x()),
                      point.y());
 }
 
+LayoutBox* LayoutBox::locationContainer() const {

[chrishtr, 2016/10/04 18:25:59]

Please add a unittest that tests this method directly.

[Xianzhu, 2016/10/04 19:20:30]

Done.

+  // Normally the box's location is relative to its containing box.
+  LayoutObject* container = this->container();
+  while (container && !container->isBox())
+    container = container->container();
+  return toLayoutBox(container);
+}
+
 LayoutPoint LayoutBox::topLeftLocation(
     const LayoutBox* flippedBlocksContainer) const {
-  const LayoutBox* containerBox =
-      flippedBlocksContainer ? flippedBlocksContainer : containingBlock();
-  if (!containerBox || containerBox == this)
+  const LayoutBox* containerBox;
+  if (flippedBlocksContainer) {
+    DCHECK(flippedBlocksContainer == locationContainer());
+    containerBox = flippedBlocksContainer;
+  } else {
+    containerBox = locationContainer();
+  }
+  if (!containerBox)
     return location();
   return containerBox->flipForWritingModeForChild(this, location());
 }
 
 bool LayoutBox::hasRelativeLogicalWidth() const {
   return style()->logicalWidth().isPercentOrCalc() ||
          style()->logicalMinWidth().isPercentOrCalc() ||
          style()->logicalMaxWidth().isPercentOrCalc();
 }
 
@@ skipping 399 matching lines @@
   LayoutRect rect = frameRect();
 
   LayoutBlock* block = containingBlock();
   if (block)
     block->adjustChildDebugRect(rect);
 
   return rect;
 }
 
 }  // namespace blink