Helper method for non-direct beforeChild in LayoutBlock::addChild().

third_party/WebKit/Source/core/layout/LayoutBlock.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2007 David Smith (catfish.man@gmail.com)
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) Research In Motion Limited 2010. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 359 matching lines @@
     }
     setHasOverflowClip(shouldClipOverflow);
 }
 
 bool LayoutBlock::allowsOverflowClip() const
 {
     // If overflow has been propagated to the viewport, it has no effect here.
     return node() != document().viewportDefiningElement();
 }
 
+void LayoutBlock::addChildBeforeDescendant(LayoutObject* newChild, LayoutObject* beforeDescendant)
+{
+    ASSERT(beforeDescendant->parent() != this);
+    LayoutObject* beforeDescendantContainer = beforeDescendant->parent();
+    while (beforeDescendantContainer->parent() != this)
+        beforeDescendantContainer = beforeDescendantContainer->parent();
+    ASSERT(beforeDescendantContainer);
+
+    // We really can't go on if what we have found isn't anonymous. We're not supposed to use some
+    // random non-anonymous object and put the child there. That's a recipe for security issues.
+    RELEASE_ASSERT(beforeDescendantContainer->isAnonymous());

[mstensho (USE GERRIT), 2016/05/11 21:06:00]

Here's a difference. We previously allowed this situation. addChild() would just
happily go on with a |this| and |beforeChild| that didn't have a direct
parent/child relationship, which is just scary.

This assertion caught a mistake in one of the unit tests (it wanted to insert a
DOM child into a DOM parent before a DOM grandchild of said parent), which is
also fixed in this CL.

[eae, 2016/05/11 21:10:11]

Yay!

+
+    // If the requested insertion point is not one of our children, then this is because
+    // there is an anonymous container within this object that contains the beforeDescendant.
+    if (beforeDescendantContainer->isAnonymousBlock()
+        // Full screen layoutObjects and full screen placeholders act as anonymous blocks, not tables:
+        || beforeDescendantContainer->isLayoutFullScreen()
+        || beforeDescendantContainer->isLayoutFullScreenPlaceholder()) {
+        // Insert the child into the anonymous block box instead of here.
+        if (newChild->isInline() || newChild->isFloatingOrOutOfFlowPositioned() || beforeDescendant->parent()->slowFirstChild() != beforeDescendant)
+            beforeDescendant->parent()->addChild(newChild, beforeDescendant);
+        else
+            addChild(newChild, beforeDescendant->parent());
+        return;
+    }
+
+    ASSERT(beforeDescendantContainer->isTable());
+    if (newChild->isTablePart()) {
+        // Insert into the anonymous table.
+        beforeDescendantContainer->addChild(newChild, beforeDescendant);
+        return;
+    }
+
+    LayoutObject* beforeChild = splitAnonymousBoxesAroundChild(beforeDescendant);
+
+    ASSERT(beforeChild->parent() == this);
+    if (beforeChild->parent() != this) {
+        // We should never reach here. If we do, we need to use the
+        // safe fallback to use the topmost beforeChild container.
+        beforeChild = beforeDescendantContainer;
+    }
+
+    addChild(newChild, beforeChild);
+}
+
 void LayoutBlock::addChild(LayoutObject* newChild, LayoutObject* beforeChild)
 {
     if (beforeChild && beforeChild->parent() != this) {
-        LayoutObject* beforeChildContainer = beforeChild->parent();
-        while (beforeChildContainer->parent() != this)
-            beforeChildContainer = beforeChildContainer->parent();
-        ASSERT(beforeChildContainer);
-
-        if (beforeChildContainer->isAnonymous()) {
-            // If the requested beforeChild is not one of our children, then this is because
-            // there is an anonymous container within this object that contains the beforeChild.
-            LayoutObject* beforeChildAnonymousContainer = beforeChildContainer;
-            if (beforeChildAnonymousContainer->isAnonymousBlock()
-                // Full screen layoutObjects and full screen placeholders act as anonymous blocks, not tables:
-                || beforeChildAnonymousContainer->isLayoutFullScreen()
-                || beforeChildAnonymousContainer->isLayoutFullScreenPlaceholder()
-                ) {
-                // Insert the child into the anonymous block box instead of here.
-                if (newChild->isInline() || newChild->isFloatingOrOutOfFlowPositioned() || beforeChild->parent()->slowFirstChild() != beforeChild)
-                    beforeChild->parent()->addChild(newChild, beforeChild);
-                else
-                    addChild(newChild, beforeChild->parent());
-                return;
-            }
-
-            ASSERT(beforeChildAnonymousContainer->isTable());
-            if (newChild->isTablePart()) {
-                // Insert into the anonymous table.
-                beforeChildAnonymousContainer->addChild(newChild, beforeChild);
-                return;
-            }
-
-            beforeChild = splitAnonymousBoxesAroundChild(beforeChild);
-
-            ASSERT(beforeChild->parent() == this);
-            if (beforeChild->parent() != this) {
-                // We should never reach here. If we do, we need to use the
-                // safe fallback to use the topmost beforeChild container.
-                beforeChild = beforeChildContainer;
-            }
-        }
+        addChildBeforeDescendant(newChild, beforeChild);
+        return;
     }
 
     bool madeBoxesNonInline = false;
 
     // A block has to either have all of its children inline, or all of its children as blocks.
     // So, if our children are currently inline and a block child has to be inserted, we move all our
     // inline children into anonymous block boxes.
     if (childrenInline() && !newChild->isInline() && !newChild->isFloatingOrOutOfFlowPositioned()) {
         // This is a block with inline content. Wrap the inline content in anonymous blocks.
         makeChildrenNonInline(beforeChild);
@@ skipping 1822 matching lines @@
         for (TrackedLayoutBoxListHashSet::const_iterator it = positionedDescendantSet->begin(); it != end; ++it) {
             LayoutBox* currBox = *it;
             ASSERT(!currBox->needsLayout());
         }
     }
 }
 
 #endif
 
 } // namespace blink