Ensure we compute the height of replaced elements to 'auto' when appropriate.

Source/core/rendering/RenderBoxModelObject.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2005 Allan Sandfeld Jensen (kde@carewolf.com)
  *           (C) 2005, 2006 Samuel Weinig (sam.weinig@gmail.com)
  * Copyright (C) 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ skipping 172 matching lines @@
     // what the CSS spec says to do with heights. Basically we
     // don't care if the cell specified a height or not.
     if (cb->isTableCell())
         return false;
 
     // Match RenderBox::availableLogicalHeightUsing by special casing
     // the render view. The available height is taken from the frame.
     if (cb->isRenderView())
         return false;
 
-    if (!cb->style()->logicalHeight().isAuto() || (!cb->style()->logicalTop().isAuto() && !cb->style()->logicalBottom().isAuto()))
+    if (!cb->style()->logicalTop().isAuto() && !cb->style()->logicalBottom().isAuto())

[davve, 2014/06/30 08:52:37]

This line still looks suspect. I filed https://codereview.chromium.org/359673003
and http://code.google.com/p/chromium/issues/detail?id=390101 to investigate.

+        return false;
+
+    // If the height of the containing block computes to 'auto', then it hasn't been 'specified explictly'.
+    if (!cb->hasAutoHeightOrContainingBlockWithAutoHeight())
         return false;
 
     return true;
 }
 
 LayoutSize RenderBoxModelObject::relativePositionOffset() const
 {
     LayoutSize offset = accumulateInFlowPositionOffsets(this);
 
     RenderBlock* containingBlock = this->containingBlock();
@@ skipping 2636 matching lines @@
     ASSERT(!beforeChild || toBoxModelObject == beforeChild->parent());
     for (RenderObject* child = startChild; child && child != endChild; ) {
         // Save our next sibling as moveChildTo will clear it.
         RenderObject* nextSibling = child->nextSibling();
         moveChildTo(toBoxModelObject, child, beforeChild, fullRemoveInsert);
         child = nextSibling;
     }
 }
 
 } // namespace WebCore