BASELINE: Update Chromium to 75.0.3770.116

Change-Id: Ifcd5227841577e8ce81a1b7a54c56caba4d85e02
Reviewed-by: Michal Klocek <michal.klocek@qt.io>

1 files changed, 9 insertions, 0 deletions

diff --git a/chromium/third_party/blink/renderer/core/layout/layout_block.cc b/chromium/third_party/blink/renderer/core/layout/layout_block.cc
index 481a0be7dc1..cbbd9281df3 100644
--- a/chromium/third_party/blink/renderer/core/layout/layout_block.cc
+++ b/chromium/third_party/blink/renderer/core/layout/layout_block.cc
@@ -1128,6 +1128,15 @@ void LayoutBlock::RemovePositionedObjects(
 }
 
 void LayoutBlock::AddPercentHeightDescendant(LayoutBox* descendant) {
+  // A replaced object is incapable of properly acting as a containing block for
+  // its children (this is an issue with VIDEO elements, for instance, which
+  // inserts some percentage height flexbox children). Assert that the
+  // descendant hasn't escaped from within a replaced object. Registering the
+  // percentage height descendant further up in the tree is only going to cause
+  // trouble, especially if the replaced object is out-of-flow positioned (and
+  // we failed to notice).
+  DCHECK(!descendant->Container()->IsLayoutReplaced());
+
   if (descendant->PercentHeightContainer()) {
     if (descendant->PercentHeightContainer() == this) {
       DCHECK(HasPercentHeightDescendant(descendant));