Move collapseAnonymousBlockChild() to LayoutBlockFlow, and make it non-static.

third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 2367 matching lines @@
         }
     }
 
     LayoutBlock::removeChild(oldChild);
 
     LayoutObject* child = prev ? prev : next;
     if (mergedAnonymousBlocks && child && !child->previousSibling() && !child->nextSibling()) {
         // The removal has knocked us down to containing only a single anonymous
         // box.  We can go ahead and pull the content right back up into our
         // box.
-        collapseAnonymousBlockChild(this, toLayoutBlock(child));
+        collapseAnonymousBlockChild(toLayoutBlockFlow(child));
     }
 
     if (!firstChild()) {
         // If this was our last child be sure to clear out our line boxes.
         if (childrenInline())
             deleteLineBoxTree();
 
         // If we are an empty anonymous block in the continuation chain,
         // we need to remove ourself and fix the continuation chain.
         if (!beingDestroyed() && isAnonymousBlockContinuation() && !oldChild->isListMarker()) {
@@ skipping 80 matching lines @@
         newContainer->reparentSubsequentFloatingOrOutOfFlowSiblings();
         return;
     }
     LayoutObject* next = child->nextSibling();
     if (next && next->isAnonymousBlock() && next->isLayoutBlockFlow()) {
         LayoutBlockFlow* newContainer = toLayoutBlockFlow(next);
         moveChildTo(newContainer, child, newContainer->firstChild(), false);
     }
 }
 
+void LayoutBlockFlow::collapseAnonymousBlockChild(LayoutBlockFlow* child)
+{
+    // It's possible that this block's destruction may have been triggered by the
+    // child's removal. Just bail if the anonymous child block is already being
+    // destroyed. See crbug.com/282088
+    if (child->beingDestroyed())
+        return;
+    if (child->continuation())
+        return;
+    // Ruby elements use anonymous wrappers for ruby runs and ruby bases by design, so we don't remove them.
+    if (child->isRubyRun() || child->isRubyBase())
+        return;
+    setNeedsLayoutAndPrefWidthsRecalcAndFullPaintInvalidation(LayoutInvalidationReason::ChildAnonymousBlockChanged);
+
+    child->moveAllChildrenTo(this, child->nextSibling(), child->hasLayer());
+    setChildrenInline(child->childrenInline());
+
+    children()->removeChildNode(this, child, child->hasLayer());
+    child->destroy();
+}
+
 static bool isMergeableAnonymousBlock(const LayoutBlockFlow* block)
 {
     return block->isAnonymousBlock() && !block->continuation() && !block->beingDestroyed() && !block->isRubyRun() && !block->isRubyBase();
 }
 
 bool LayoutBlockFlow::mergeSiblingContiguousAnonymousBlock(LayoutBlockFlow* siblingThatMayBeDeleted)
 {
     // Note: |this| and |siblingThatMayBeDeleted| may not be adjacent siblings at this point. There
     // may be an object between them which is about to be removed.
 
@@ skipping 48 matching lines @@
         child = sibling;
     }
 }
 
 void LayoutBlockFlow::makeChildrenInlineIfPossible()
 {
     // Collapsing away anonymous wrappers isn't relevant for the children of anonymous blocks, unless they are ruby bases.
     if (isAnonymousBlock() && !isRubyBase())
         return;
 
-    Vector<LayoutBlock*, 3> blocksToRemove;
+    Vector<LayoutBlockFlow*, 3> blocksToRemove;
     for (LayoutObject* child = firstChild(); child; child = child->nextSibling()) {
         if (child->isFloating())
             continue;
         if (child->isOutOfFlowPositioned())
             continue;
 
         // There are still block children in the container, so any anonymous wrappers are still needed.
-        if (!child->isAnonymousBlock())
+        if (!child->isAnonymousBlock() || !child->isLayoutBlockFlow())
             return;
         // If one of the children is being destroyed then it is unsafe to clean up anonymous wrappers as the
         // entire branch may be being destroyed.
         if (toLayoutBlock(child)->beingDestroyed())
             return;
         // We can't remove anonymous wrappers if they contain continuations as this means there are block children present.
         if (toLayoutBlock(child)->continuation())
             return;
         // We are only interested in removing anonymous wrappers if there are inline siblings underneath them.
         if (!child->childrenInline())
             return;
         // Ruby elements use anonymous wrappers for ruby runs and ruby bases by design, so we don't remove them.
         if (child->isRubyRun() || child->isRubyBase())
             return;
 
-        blocksToRemove.append(toLayoutBlock(child));
+        blocksToRemove.append(toLayoutBlockFlow(child));
     }
 
     // If we make an object's children inline we are going to frustrate any future attempts to remove
     // floats from its children's float-lists before the next layout happens so clear down all the floatlists
     // now - they will be rebuilt at layout.
     removeFloatingObjectsFromDescendants();
 
     for (size_t i = 0; i < blocksToRemove.size(); i++)
-        collapseAnonymousBlockChild(this, blocksToRemove[i]);
+        collapseAnonymousBlockChild(blocksToRemove[i]);
     setChildrenInline(true);
 }
 
 void LayoutBlockFlow::invalidatePaintForOverhangingFloats(bool paintAllDescendants)
 {
     // Invalidate paint of any overhanging floats (if we know we're the one to paint them).
     // Otherwise, bail out.
     if (!hasOverhangingFloats())
         return;
 
@@ skipping 1068 matching lines @@
             if (!rect.isEmpty())
                 rects.append(rect);
         }
     }
 
     if (inlineElementContinuation)
         inlineElementContinuation->addOutlineRects(rects, additionalOffset + (inlineElementContinuation->containingBlock()->location() - location()), includeBlockOverflows);
 }
 
 } // namespace blink