Fold out-of-flow objects into anonymous blocks when removing children

third_party/WebKit/Source/core/layout/LayoutBlock.cpp

Index: third_party/WebKit/Source/core/layout/LayoutBlock.cpp
diff --git a/third_party/WebKit/Source/core/layout/LayoutBlock.cpp b/third_party/WebKit/Source/core/layout/LayoutBlock.cpp
index 75fabaddfae7c3372eb547349e52000fce1ab42a..5e38121ab0a62c05194c4846c950c5706fa1a7fe 100644
--- a/third_party/WebKit/Source/core/layout/LayoutBlock.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutBlock.cpp
@@ -369,6 +369,16 @@ void LayoutBlock::invalidateDisplayItemClients(const LayoutBoxModelObject& paint
     invalidateDisplayItemClientForStartOfContinuationsIfNeeded(*this);
 }
 
+static void addSubsequentFloatingSiblingsToBlock(LayoutBlock* block, LayoutBlock* container)

[mstensho (USE GERRIT), 2015/10/29 20:00:26]

FloatingOrOutOfFlowSiblings

+{
+    LayoutObject* child = block->nextSibling();
+    while (child && child->isFloatingOrOutOfFlowPositioned()) {
+        LayoutObject* sibling = child->nextSibling();
+        container->moveChildTo(block, child, nullptr, false);
+        child = sibling;
+    }
+}
+
 void LayoutBlock::addChildIgnoringContinuation(LayoutObject* newChild, LayoutObject* beforeChild)
 {
     if (beforeChild && beforeChild->parent() != this) {
@@ -435,6 +445,7 @@ void LayoutBlock::addChildIgnoringContinuation(LayoutObject* newChild, LayoutObj
 
         if (afterChild && afterChild->isAnonymousBlock()) {
             afterChild->addChild(newChild);
+            addSubsequentFloatingSiblingsToBlock(toLayoutBlock(afterChild), this);

[mstensho (USE GERRIT), 2015/10/29 20:00:26]

Why would there be subsequent floats or out-of-flow objects after an anonymous
block? Don't we already have code to wrap them inside such anonymous blocks?

Oh, I see... Nice testcase. :)

No, wait a minute!

The TC goes like this:

LayoutBlock (anonymous)
    BR
LayoutBlock (DIV #first .block)
LayoutBlock (DIV .float)

Then we change #first from block to inline-block. First we detach the old layout
object:

LayoutBlock (anonymous)
    BR
LayoutBlock (DIV .float)

I guess my question is: why don't we wrap the float inside the anonymous block
right away here? Why is there stuff like this to clean up when inserting the new
#first inline-block layout object? Shouldn't the final lines in
LayoutBlock::removeChild() take care of that?

             return;
         }
 
@@ -450,12 +461,7 @@ void LayoutBlock::addChildIgnoringContinuation(LayoutObject* newChild, LayoutObj
                 child = sibling;
             }
             newBox->addChild(newChild);
-            child = newBox->nextSibling();
-            while (child && child->isFloatingOrOutOfFlowPositioned()) {
-                LayoutObject* sibling = child->nextSibling();
-                moveChildTo(newBox, child, nullptr, false);
-                child = sibling;
-            }
+            addSubsequentFloatingSiblingsToBlock(newBox, this);
             return;
         }
     }