[css-grid] Fix simplified layout of positioned grid items

third_party/WebKit/Source/core/layout/LayoutGrid.cpp

 /*
  * Copyright (C) 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 454 matching lines @@
   // more specific condition to detect whether child's min-content contribution
   // has changed or not.
   if (m_hasAnyOrthogonalChildren) {
     computeTrackSizesForDefiniteSize(ForColumns, sizingData,
                                      availableSpaceForColumns);
     computeTrackSizesForDefiniteSize(ForRows, sizingData,
                                      availableSpaceForRows);
   }
 }
 
+bool LayoutGrid::simplifiedLayout() {
+  // This is a way to protect simplifiedLayout(), as we cannot perform it
+  // on a dirty grid that has positioned items to be layout.
+  if (m_gridIsDirty && posChildNeedsLayout())
+    return false;
+
+  return LayoutBlock::simplifiedLayout();
+}
+
 void LayoutGrid::layoutBlock(bool relayoutChildren) {
   ASSERT(needsLayout());
 
   if (!relayoutChildren && simplifiedLayout())
     return;
 
   SubtreeLayoutScope layoutScope(*this);
 
   {
     // LayoutState needs this deliberate scope to pop before updating scroll
@@ skipping 2951 matching lines @@
   if (!m_gridItemArea.isEmpty())
     GridPainter(*this).paintChildren(paintInfo, paintOffset);
 }
 
 bool LayoutGrid::cachedHasDefiniteLogicalHeight() const {
   SECURITY_DCHECK(m_hasDefiniteLogicalHeight);
   return m_hasDefiniteLogicalHeight.value();
 }
 
 }  // namespace blink