Fix ScrollAnchor descent into absolute-positioned containers.

third_party/WebKit/Source/core/layout/ScrollAnchor.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/layout/ScrollAnchor.h"
 
 #include "core/frame/FrameView.h"
 #include "core/frame/UseCounter.h"
 #include "core/layout/LayoutBlockFlow.h"
 #include "core/layout/api/LayoutBoxItem.h"
@@ skipping 107 matching lines @@
       return false;
   }
 
   LayoutObject::AncestorSkipInfo skipInfo(scrollerLayoutBox(scroller));
   candidate->container(&skipInfo);
   return !skipInfo.ancestorSkipped();
 }
 
 ScrollAnchor::ExamineResult ScrollAnchor::examine(
     const LayoutObject* candidate) const {
+  if (candidate == scrollerLayoutBox(m_scroller))
+    return ExamineResult(Continue);
+
   if (candidate->isLayoutInline())
     return ExamineResult(Continue);
 
   // Anonymous blocks are not in the DOM tree and it may be hard for
   // developers to reason about the anchor node.
   if (candidate->isAnonymous())
     return ExamineResult(Continue);
 
   if (!candidate->isText() && !candidate->isBox())
     return ExamineResult(Skip);
@@ skipping 14 matching lines @@
         visibleRect.contains(candidateRect) ? Return : Constrain,
         cornerToAnchor(m_scroller));
   } else {
     return ExamineResult(Skip);
   }
 }
 
 void ScrollAnchor::findAnchor() {
   TRACE_EVENT0("blink", "ScrollAnchor::findAnchor");
   SCOPED_BLINK_UMA_HISTOGRAM_TIMER("Layout.ScrollAnchor.TimeToFindAnchor");
+  findAnchorRecursive(scrollerLayoutBox(m_scroller));
+}
 
-  LayoutObject* stayWithin = scrollerLayoutBox(m_scroller);
-  LayoutObject* candidate = stayWithin->nextInPreOrder(stayWithin);
-  while (candidate) {
-    ExamineResult result = examine(candidate);
-    if (result.viable) {
-      m_anchorObject = candidate;
-      m_corner = result.corner;
-    }
-    switch (result.status) {
-      case Skip:
-        candidate = candidate->nextInPreOrderAfterChildren(stayWithin);
-        break;
-      case Constrain:
-        stayWithin = candidate;
-      // fall through
-      case Continue:
-        candidate = candidate->nextInPreOrder(stayWithin);
-        break;
-      case Return:
-        return;
+bool ScrollAnchor::findAnchorRecursive(LayoutObject* candidate) {
+  ExamineResult result = examine(candidate);
+  if (result.viable) {
+    m_anchorObject = candidate;
+    m_corner = result.corner;
+  }
+
+  if (result.status == Return)
+    return true;
+
+  if (result.status == Skip)
+    return false;
+
+  for (LayoutObject* child = candidate->slowFirstChild(); child;
+       child = child->nextSibling()) {
+    if (findAnchorRecursive(child))
+      return true;
+  }
+
+  // Make a separate pass to catch positioned descendants with a static DOM
+  // parent that we skipped over (crbug.com/692701).
+  if (candidate->isLayoutBlock()) {
+    if (TrackedLayoutBoxListHashSet* positionedDescendants =
+            toLayoutBlock(candidate)->positionedObjects()) {
+      for (LayoutBox* descendant : *positionedDescendants) {
+        if (descendant->parent() != candidate) {
+          if (findAnchorRecursive(descendant))
+            return true;
+        }
+      }
     }
   }
+
+  if (result.status == Constrain)
+    return true;
+
+  DCHECK(result.status == Continue);
+  return false;
 }
 
 bool ScrollAnchor::computeScrollAnchorDisablingStyleChanged() {
   LayoutObject* current = anchorObject();
   if (!current)
     return false;
 
   LayoutObject* scrollerBox = scrollerLayoutBox(m_scroller);
   while (true) {
     DCHECK(current);
@@ skipping 134 matching lines @@
 bool ScrollAnchor::refersTo(const LayoutObject* layoutObject) const {
   return m_anchorObject == layoutObject;
 }
 
 void ScrollAnchor::notifyRemoved(LayoutObject* layoutObject) {
   if (m_anchorObject == layoutObject)
     clearSelf();
 }
 
 }  // namespace blink