Ensure text nodes get an object if we're unsure that they will be collapsed

third_party/WebKit/Source/core/dom/Text.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
@@ skipping 289 matching lines @@
             return false;
 
         // Avoiding creation of a layoutObject for the text node is a non-essential memory optimization.
         // So to avoid blowing up on very wide DOMs, we limit the number of siblings to visit.
         unsigned maxSiblingsToVisit = 50;
 
         LayoutObject* first = parent.slowFirstChild();
         while (first && first->isFloatingOrOutOfFlowPositioned() && maxSiblingsToVisit--)
             first = first->nextSibling();
         if (!first || first == layoutObject() || LayoutTreeBuilderTraversal::nextSiblingLayoutObject(*this) == first) {
+            // If we're adding children to this flow our previous siblings are not in the layout tree yet so we
+            // cannot know if we will be the first child in the line and collapse away. We have to assume we need a layout object.
+            Node* firstChildNode = parent.node() ? LayoutTreeBuilderTraversal::firstChild(*parent.node()) : nullptr;

[esprehn, 2015/12/03 07:03:32]

this doesn't work if your parent is anonymous, are you sure this is right? when
is node() null?

[rhogan, 2015/12/03 19:45:32]

Right enough, I hadn't thought of that but in the cases where we're deciding
whether to add an object we never end up in textLayoutObjectIsNeeded unless the
parent object has a node so this only happens when called from
updateTextLayoutObject. I think we're right to miss out on the optimization in
such situations so I need to account for that here.
LayoutTests/fast/css/image-set-value-not-removed-crash.html manages it when
calling from updateTextLayoutObject() during editing.

+            if (first && first == layoutObject() && firstChildNode && !firstChildNode->layoutObject())

[esprehn, 2015/12/03 07:03:32]

This is saying "if we're the first in flow layout object, and there's a previous
sibling that doesn't have a layout object yet."

that'll always be true if the first child is display: none, is that correct?

[rhogan, 2015/12/03 19:45:32]

Sure, and in that situation we would create a text layout object that would get
collapsed away. The purpose here is to avoid that in the common cases. The bug
we're fixing is in the other direction - the text object isn't getting created
when it's needed.

+                return true;
+
             // Whitespace at the start of a block just goes away.  Don't even
             // make a layout object for this text.
             return false;
         }
     }
     return true;
 }
 
 static bool isSVGText(Text* text)
 {
@@ skipping 114 matching lines @@
             result.appendLiteral("; ");
         result.appendLiteral("value=");
         result.append(s);
     }
 
     strncpy(buffer, result.toString().utf8().data(), length - 1);
 }
 #endif
 
 } // namespace blink