Dirty line boxes correctly when a float gets layout

third_party/WebKit/Source/core/layout/LayoutBlockFlowLine.cpp

 /*
  * Copyright (C) 2000 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2003, 2004, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All right reserved.
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
@@ skipping 1572 matching lines @@
                 box->setMayNeedPaintInvalidation();
 
                 updateBlockChildDirtyBitsBeforeLayout(relayoutChildren, *box);
 
                 if (o->isOutOfFlowPositioned()) {
                     o->containingBlock()->insertPositionedObject(box);
                 } else if (o->isFloating()) {
                     layoutState.floats().append(FloatWithRect(box));
                     if (box->needsLayout()) {
                         box->layout();
-                        markLinesDirtyInBlockRange(toLayoutBox(o)->logicalTop(), toLayoutBox(o)->logicalBottom());
+                        // Dirty any lineboxes potentially affected by the float, but don't search outside this
+                        // object as we are only interested in dirtying lineboxes to which we may attach the float.
+                        dirtyLinesFromChangedChild(box, MarkOnlyThis);
                     }
                 } else if (isFullLayout || o->needsLayout()) {
                     // Atomic inline.
                     box->dirtyLineBoxes(isFullLayout);
                     o->layoutIfNeeded();
                 }
             } else if (o->isText() || (o->isLayoutInline() && !walker.atEndOfInline())) {
                 if (!o->isText())
                     toLayoutInline(o)->updateAlwaysCreateLineBoxes(layoutState.isFullLayout());
                 if (layoutState.isFullLayout() || o->selfNeedsLayout())
@@ skipping 481 matching lines @@
     if (!line || !line->isFirstLineStyle())
         return reason;
     // It's the RootInlineBox that paints the ::first-line background. Note that since it may be
     // expensive to figure out if the first line is affected by any ::first-line selectors at all,
     // we just invalidate it unconditionally, since that's typically cheaper.
     invalidateDisplayItemClient(*line);
     return reason;
 }
 
 } // namespace blink