Fix when orthogonal writing mode roots have floating siblings

third_party/WebKit/Source/core/frame/FrameView.cpp

 /*
  * Copyright (C) 1998, 1999 Torben Weis <weis@kde.org>
  *                     1999 Lars Knoll <knoll@kde.org>
  *                     1999 Antti Koivisto <koivisto@kde.org>
  *                     2000 Dirk Mueller <mueller@kde.org>
  * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
  *           (C) 2006 Graham Dennis (graham.dennis@gmail.com)
  *           (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  * Copyright (C) 2009 Google Inc. All rights reserved.
  *
@@ skipping 1839 matching lines @@
 void FrameView::removeOrthogonalWritingModeRoot(LayoutBox& root)
 {
     m_orthogonalWritingModeRootList.remove(root);
 }
 
 bool FrameView::hasOrthogonalWritingModeRoots() const
 {
     return !m_orthogonalWritingModeRootList.isEmpty();
 }
 
+static inline void removeFloatingObjectsForSubtreeRoot(LayoutObject& root)
+{
+    // TODO(kojii): Under certain conditions, moveChildTo() defers
+    // removeFloatingObjects() until the containing block layouts. For
+    // instance, when descendants of the moving child is floating,
+    // removeChildNode() does not clear them. In such cases, at this
+    // point, FloatingObjects may contain old or even deleted objects.
+    // Dealing this in markAllDescendantsWithFloatsForLayout() could
+    // solve, but since that is likely to suffer the performance and
+    // since the containing block of orthogonal writing mode roots
+    // having floats is very rare, prefer to re-create
+    // FloatingObjects.
+    if (LayoutBlock* cb = root.containingBlock()) {
+        if (cb->needsLayout() && cb->isLayoutBlockFlow())
+            toLayoutBlockFlow(cb)->removeFloatingObjects();
+    }
+}
+
 void FrameView::layoutOrthogonalWritingModeRoots()
 {
     for (auto& root : m_orthogonalWritingModeRootList.ordered()) {
         ASSERT(root->isBox() && toLayoutBox(*root).isOrthogonalWritingModeRoot());
         if (!root->needsLayout()
             || root->isOutOfFlowPositioned()
             || root->isColumnSpanAll()
             || !root->styleRef().logicalHeight().isIntrinsicOrAuto()) {
             continue;
         }
-        LayoutState layoutState(*root);
-        root->layout();
+
+        removeFloatingObjectsForSubtreeRoot(*root);
+        layoutFromRootObject(*root);
     }
 }
 
 bool FrameView::checkLayoutInvalidationIsAllowed() const
 {
     if (m_allowsLayoutInvalidationAfterLayoutClean)
         return true;
 
     // If we are updating all lifecycle phases beyond LayoutClean, we don't expect dirty layout after LayoutClean.
     CHECK_FOR_DIRTY_LAYOUT(lifecycle().state() < DocumentLifecycle::LayoutClean);
@@ skipping 2471 matching lines @@
 }
 
 bool FrameView::canThrottleRendering() const
 {
     if (!RuntimeEnabledFeatures::renderingPipelineThrottlingEnabled())
         return false;
     return m_subtreeThrottled || (m_hiddenForThrottling && m_crossOriginForThrottling);
 }
 
 } // namespace blink