BASELINE: Update Chromium to 86.0.4240.124

Change-Id: Ide0ff151e94cd665ae6521a446995d34a9d1d644
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>

1 files changed, 14 insertions, 0 deletions

diff --git a/chromium/third_party/blink/renderer/core/layout/ng/flex/layout_ng_flexible_box.cc b/chromium/third_party/blink/renderer/core/layout/ng/flex/layout_ng_flexible_box.cc
index 7ecffbcf6c1..8a185309025 100644
--- a/chromium/third_party/blink/renderer/core/layout/ng/flex/layout_ng_flexible_box.cc
+++ b/chromium/third_party/blink/renderer/core/layout/ng/flex/layout_ng_flexible_box.cc
@@ -4,6 +4,7 @@
 
 #include "third_party/blink/renderer/core/layout/ng/flex/layout_ng_flexible_box.h"
 
+#include "third_party/blink/renderer/core/html/forms/html_select_element.h"
 #include "third_party/blink/renderer/core/layout/layout_analyzer.h"
 #include "third_party/blink/renderer/core/layout/layout_view.h"
 #include "third_party/blink/renderer/core/layout/ng/ng_block_node.h"
@@ -62,6 +63,19 @@ void MergeAnonymousFlexItems(LayoutObject* remove_child) {
 
 }  // namespace
 
+// See LayoutFlexibleBox::IsChildAllowed().
+bool LayoutNGFlexibleBox::IsChildAllowed(LayoutObject* object,
+                                         const ComputedStyle& style) const {
+  const auto* select = DynamicTo<HTMLSelectElement>(GetNode());
+  if (UNLIKELY(select && select->UsesMenuList())) {
+    // For a size=1 <select>, we only render the active option label through the
+    // InnerElement. We do not allow adding layout objects for options and
+    // optgroups.
+    return object->GetNode() == &select->InnerElement();
+  }
+  return LayoutNGMixin<LayoutBlock>::IsChildAllowed(object, style);
+}
+
 void LayoutNGFlexibleBox::RemoveChild(LayoutObject* child) {
   if (!DocumentBeingDestroyed() &&
       !StyleRef().IsDeprecatedFlexboxUsingFlexLayout())