Out-of-flow objects inside multicol may not establish column sets.

Source/core/layout/LayoutMultiColumnFlowThread.cpp

 /*
  * Copyright (C) 2012 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 55 matching lines @@
 
 LayoutMultiColumnSet* LayoutMultiColumnFlowThread::lastMultiColumnSet() const
 {
     for (LayoutObject* sibling = multiColumnBlockFlow()->lastChild(); sibling; sibling = sibling->previousSibling()) {
         if (sibling->isLayoutMultiColumnSet())
             return toLayoutMultiColumnSet(sibling);
     }
     return 0;
 }
 
+static LayoutObject* nextInPreOrderAfterChildrenSkippingOutOfFlow(LayoutMultiColumnFlowThread* flowThread, LayoutObject* descendant)
+{
+    ASSERT(descendant->isDescendantOf(flowThread));
+    LayoutObject* object = descendant->nextInPreOrderAfterChildren(flowThread);
+    while (object) {
+        // Walk through the siblings and find the first one which is either in-flow or has this
+        // flow thread as its containing block flow thread.
+        if (!object->isOutOfFlowPositioned())
+            break;
+        if (object->containingBlock()->flowThreadContainingBlock() == flowThread) {
+            // This out-of-flow object is still part of the flow thread, because its containing
+            // block (probably relatively positioned) is part of the flow thread.
+            break;
+        }
+        object = object->nextInPreOrderAfterChildren(flowThread);
+    }
+    return object;
+}
+
+static LayoutObject* previousInPreOrderSkippingOutOfFlow(LayoutMultiColumnFlowThread* flowThread, LayoutObject* descendant)
+{
+    ASSERT(descendant->isDescendantOf(flowThread));
+    LayoutObject* object = descendant->previousInPreOrder(flowThread);
+    while (object && object != flowThread) {
+        // Walk through the siblings and find the first one which is either in-flow or has this
+        // flow thread as its containing block flow thread.
+        if (!object->isOutOfFlowPositioned())
+            break;
+        if (object->containingBlock()->flowThreadContainingBlock() == flowThread) {
+            // This out-of-flow object is still part of the flow thread, because its containing
+            // block (probably relatively positioned) is part of the flow thread.
+            break;
+        }
+        object = object->previousInPreOrder(flowThread);
+    }
+    return object && object != flowThread ? object : nullptr;
+}
+
 static LayoutObject* firstLayoutObjectInSet(LayoutMultiColumnSet* multicolSet)
 {
     LayoutBox* sibling = multicolSet->previousSiblingMultiColumnBox();
     if (!sibling)
         return multicolSet->flowThread()->firstChild();
     // Adjacent column content sets should not occur. We would have no way of figuring out what each
     // of them contains then.
     ASSERT(sibling->isLayoutMultiColumnSpannerPlaceholder());
-    return toLayoutMultiColumnSpannerPlaceholder(sibling)->layoutObjectInFlowThread()->nextInPreOrderAfterChildren(multicolSet->flowThread());
+    LayoutBox* spanner = toLayoutMultiColumnSpannerPlaceholder(sibling)->layoutObjectInFlowThread();
+    return nextInPreOrderAfterChildrenSkippingOutOfFlow(multicolSet->multiColumnFlowThread(), spanner);
 }
 
 static LayoutObject* lastLayoutObjectInSet(LayoutMultiColumnSet* multicolSet)
 {
     LayoutBox* sibling = multicolSet->nextSiblingMultiColumnBox();
     if (!sibling)
         return 0; // By right we should return lastLeafChild() here, but the caller doesn't care, so just return 0.
     // Adjacent column content sets should not occur. We would have no way of figuring out what each
     // of them contains then.
     ASSERT(sibling->isLayoutMultiColumnSpannerPlaceholder());
-    return toLayoutMultiColumnSpannerPlaceholder(sibling)->layoutObjectInFlowThread()->previousInPreOrder(multicolSet->flowThread());
+    LayoutBox* spanner = toLayoutMultiColumnSpannerPlaceholder(sibling)->layoutObjectInFlowThread();
+    return previousInPreOrderSkippingOutOfFlow(multicolSet->multiColumnFlowThread(), spanner);
 }
 
 LayoutMultiColumnSet* LayoutMultiColumnFlowThread::mapDescendantToColumnSet(LayoutObject* layoutObject) const
 {
     ASSERT(!containingColumnSpannerPlaceholder(layoutObject)); // should not be used for spanners or content inside them.
     ASSERT(layoutObject != this);
     ASSERT(layoutObject->isDescendantOf(this));
+    ASSERT(layoutObject->containingBlock()->isDescendantOf(this)); // Out-of-flow objects don't belong in column sets.
     LayoutMultiColumnSet* multicolSet = firstMultiColumnSet();
     if (!multicolSet)
         return 0;
     if (!multicolSet->nextSiblingMultiColumnSet())
         return multicolSet;
 
     // This is potentially SLOW! But luckily very uncommon. You would have to dynamically insert a
     // spanner into the middle of column contents to need this.
     for (; multicolSet; multicolSet = multicolSet->nextSiblingMultiColumnSet()) {
         LayoutObject* firstLayoutObject = firstLayoutObjectInSet(multicolSet);
@@ skipping 333 matching lines @@
     if (nextColumnBox && nextColumnBox->isLayoutMultiColumnSet()) {
         LayoutMultiColumnSet* nextSet = toLayoutMultiColumnSet(nextColumnBox);
         m_lastSetWorkedOn = nextSet;
         nextSet->beginFlow(logicalTopInFlowThread);
     }
     return adjustment;
 }
 
 // When processing layout objects to remove or when processing layout objects that have just been
 // inserted, certain types of objects should be skipped.
-static bool shouldSkipInsertedOrRemovedChild(const LayoutObject& child)
+static bool shouldSkipInsertedOrRemovedChild(LayoutMultiColumnFlowThread* flowThread, const LayoutObject& child)
 {
     if (child.isSVG() && !child.isSVGRoot()) {
         // Don't descend into SVG objects. What's in there is of no interest, and there might even
         // be a foreignObject there with column-span:all, which doesn't apply to us.
         return true;
     }
     if (child.isLayoutFlowThread()) {
         // Found an inner flow thread. We need to skip it and its descendants.
         return true;
     }
     if (child.isLayoutMultiColumnSet() || child.isLayoutMultiColumnSpannerPlaceholder()) {
         // Column sets and spanner placeholders in a child multicol context don't affect the parent
         // flow thread.
         return true;
     }
+    if (child.isOutOfFlowPositioned() && child.containingBlock()->flowThreadContainingBlock() != flowThread) {
+        // Out-of-flow with its containing block on the outside of the multicol container.
+        return true;
+    }
     return false;
 }
 
 void LayoutMultiColumnFlowThread::flowThreadDescendantWasInserted(LayoutObject* descendant)
 {
     ASSERT(!m_isBeingEvacuated);
-    LayoutObject* objectAfterSubtree = descendant->nextInPreOrderAfterChildren(this);
     // This method ensures that the list of column sets and spanner placeholders reflects the
     // multicol content after having inserted a descendant (or descendant subtree). See the header
     // file for more information. Go through the subtree that was just inserted and create column
     // sets (needed by regular column content) and spanner placeholders (one needed by each spanner)
     // where needed.
+    LayoutObject* objectAfterSubtree = nextInPreOrderAfterChildrenSkippingOutOfFlow(this, descendant);
     LayoutObject* next;
     for (LayoutObject* layoutObject = descendant; layoutObject; layoutObject = next) {
-        if (shouldSkipInsertedOrRemovedChild(*layoutObject)) {
+        if (shouldSkipInsertedOrRemovedChild(this, *layoutObject)) {
             next = layoutObject->nextInPreOrderAfterChildren(descendant);
             continue;
         }
         next = layoutObject->nextInPreOrder(descendant);
         if (containingColumnSpannerPlaceholder(layoutObject))
             continue; // Inside a column spanner. Nothing to do, then.
         if (descendantIsValidColumnSpanner(layoutObject)) {
             // This layoutObject is a spanner, so it needs to establish a spanner placeholder.
             LayoutBox* insertBefore = 0;
             LayoutMultiColumnSet* setToSplit = 0;
             if (objectAfterSubtree) {
                 // The spanner is inserted before something. Figure out what this entails. If the
                 // next layoutObject is a spanner too, it means that we can simply insert a new spanner
                 // placeholder in front of its placeholder.
                 insertBefore = objectAfterSubtree->spannerPlaceholder();
                 if (!insertBefore) {
                     // The next layoutObject isn't a spanner; it's regular column content. Examine what
                     // comes right before us in the flow thread, then.
-                    LayoutObject* previousLayoutObject = layoutObject->previousInPreOrder(this);
+                    LayoutObject* previousLayoutObject = previousInPreOrderSkippingOutOfFlow(this, layoutObject);
                     if (!previousLayoutObject || previousLayoutObject == this) {
                         // The spanner is inserted as the first child of the multicol container,
                         // which means that we simply insert a new spanner placeholder at the
                         // beginning.
                         insertBefore = firstMultiColumnBox();
                     } else if (LayoutMultiColumnSpannerPlaceholder* previousPlaceholder = containingColumnSpannerPlaceholder(previousLayoutObject)) {
                         // Before us is another spanner. We belong right after it then.
                         insertBefore = previousPlaceholder->nextSiblingMultiColumnBox();
                     } else {
                         // We're inside regular column content with both feet. Find out which column
                         // set this is. It needs to be split it into two sets, so that we can insert
                         // a new spanner placeholder between them.
                         setToSplit = mapDescendantToColumnSet(previousLayoutObject);
                         ASSERT(setToSplit == mapDescendantToColumnSet(objectAfterSubtree));
                         setToSplit->setNeedsLayoutAndFullPaintInvalidation(LayoutInvalidationReason::ColumnsChanged);
                         insertBefore = setToSplit->nextSiblingMultiColumnBox();
                         // We've found out which set that needs to be split. Now proceed to
                         // inserting the spanner placeholder, and then insert a second column set.
                     }
                 }
                 ASSERT(setToSplit || insertBefore);
             }
             createAndInsertSpannerPlaceholder(toLayoutBox(layoutObject), insertBefore);
             if (setToSplit)
                 createAndInsertMultiColumnSet(insertBefore);
             continue;
         }
         // This layoutObject is regular column content (i.e. not a spanner). Create a set if necessary.
-        while (objectAfterSubtree) {
-            // Walk through the siblings and find the first one which is either in-flow or has this
-            // flow thread as its containing block flow thread.
-            if (!objectAfterSubtree->isOutOfFlowPositioned()) {
-                // In-flow objects are always part of the flow thread (unless it's a spanner - but
-                // we'll deal with that further below).
-                break;
-            }
-            if (objectAfterSubtree->containingBlock()->flowThreadContainingBlock() == this) {
-                // This out-of-flow object is still part of the flow thread, because its containing
-                // block (probably relatively positioned) is part of the flow thread.
-                break;
-            }
-            objectAfterSubtree = objectAfterSubtree->nextInPreOrderAfterChildren(this);
-        }
         if (objectAfterSubtree) {
             if (LayoutMultiColumnSpannerPlaceholder* placeholder = objectAfterSubtree->spannerPlaceholder()) {
                 // If inserted right before a spanner, we need to make sure that there's a set for us there.
                 LayoutBox* previous = placeholder->previousSiblingMultiColumnBox();
                 if (!previous || !previous->isLayoutMultiColumnSet())
                     createAndInsertMultiColumnSet(placeholder);
             } else {
                 // Otherwise, since |objectAfterSubtree| isn't a spanner, it has to mean that there's
                 // already a set for that content. We can use it for this layoutObject too.
                 ASSERT(mapDescendantToColumnSet(objectAfterSubtree));
@@ skipping 14 matching lines @@
     // multicol content that we'll be left with after removal of a descendant (or descendant
     // subtree). See the header file for more information. Removing content may mean that we need to
     // remove column sets and/or spanner placeholders.
     if (m_isBeingEvacuated)
         return;
     bool hadContainingPlaceholder = containingColumnSpannerPlaceholder(descendant);
     bool processedSomething = false;
     LayoutObject* next;
     // Remove spanner placeholders that are no longer needed, and merge column sets around them.
     for (LayoutObject* layoutObject = descendant; layoutObject; layoutObject = next) {
-        if (shouldSkipInsertedOrRemovedChild(*layoutObject)) {
+        if (shouldSkipInsertedOrRemovedChild(this, *layoutObject)) {
             next = layoutObject->nextInPreOrderAfterChildren(descendant);
             continue;
         }
         processedSomething = true;
         LayoutMultiColumnSpannerPlaceholder* placeholder = layoutObject->spannerPlaceholder();
         if (!placeholder) {
             next = layoutObject->nextInPreOrder(descendant);
             continue;
         }
         next = layoutObject->nextInPreOrderAfterChildren(descendant); // It's a spanner. Its children are of no interest to us.
         if (LayoutBox* nextColumnBox = placeholder->nextSiblingMultiColumnBox()) {
             LayoutBox* previousColumnBox = placeholder->previousSiblingMultiColumnBox();
             if (nextColumnBox && nextColumnBox->isLayoutMultiColumnSet()
                 && previousColumnBox && previousColumnBox->isLayoutMultiColumnSet()) {
                 // Need to merge two column sets.
                 nextColumnBox->destroy();
                 previousColumnBox->setNeedsLayout(LayoutInvalidationReason::ColumnsChanged);
                 invalidateColumnSets();
             }
         }
         placeholder->destroy();
     }
     if (hadContainingPlaceholder || !processedSomething)
         return; // No column content will be removed, so we can stop here.
 
     // Column content will be removed. Does this mean that we should destroy a column set?
     LayoutMultiColumnSpannerPlaceholder* adjacentPreviousSpannerPlaceholder = 0;
-    LayoutObject* previousLayoutObject = descendant->previousInPreOrder(this);
+    LayoutObject* previousLayoutObject = previousInPreOrderSkippingOutOfFlow(this, descendant);
     if (previousLayoutObject && previousLayoutObject != this) {
         adjacentPreviousSpannerPlaceholder = containingColumnSpannerPlaceholder(previousLayoutObject);
         if (!adjacentPreviousSpannerPlaceholder)
             return; // Preceded by column content. Set still needed.
     }
     LayoutMultiColumnSpannerPlaceholder* adjacentNextSpannerPlaceholder = 0;
-    LayoutObject* nextLayoutObject = descendant->nextInPreOrderAfterChildren(this);
+    LayoutObject* nextLayoutObject = nextInPreOrderAfterChildrenSkippingOutOfFlow(this, descendant);
     if (nextLayoutObject) {
         adjacentNextSpannerPlaceholder = containingColumnSpannerPlaceholder(nextLayoutObject);
         if (!adjacentNextSpannerPlaceholder)
             return; // Followed by column content. Set still needed.
     }
     // We have now determined that, with the removal of |descendant|, we should remove a column
     // set. Locate it and remove it. Do it without involving mapDescendantToColumnSet(), as that
     // might be very slow. Deduce the right set from the spanner placeholders that we've already
     // found.
     LayoutMultiColumnSet* columnSetToRemove;
@@ skipping 115 matching lines @@
 }
 
 bool LayoutMultiColumnFlowThread::isPageLogicalHeightKnown() const
 {
     if (LayoutMultiColumnSet* columnSet = lastMultiColumnSet())
         return columnSet->pageLogicalHeight();
     return false;
 }
 
 }