Dirty line boxes correctly when a float gets layout

third_party/WebKit/Source/core/layout/LayoutBlockFlowLine.cpp

Index: third_party/WebKit/Source/core/layout/LayoutBlockFlowLine.cpp
diff --git a/third_party/WebKit/Source/core/layout/LayoutBlockFlowLine.cpp b/third_party/WebKit/Source/core/layout/LayoutBlockFlowLine.cpp
index 486227bc3c92845c5b6ade53d189a9572ee0d2e0..2d24f8818e9601b5138468a1742fad96d9331319 100644
--- a/third_party/WebKit/Source/core/layout/LayoutBlockFlowLine.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutBlockFlowLine.cpp
@@ -1590,7 +1590,12 @@ void LayoutBlockFlow::layoutInlineChildren(bool relayoutChildren, LayoutUnit& pa
                     layoutState.floats().append(FloatWithRect(box));
                     if (box->needsLayout()) {
                         box->layout();
-                        markLinesDirtyInBlockRange(toLayoutBox(o)->logicalTop(), toLayoutBox(o)->logicalBottom());
+                        // Dirty any lineboxes potentially affected by the float, but don't search outside this
+                        // object as we are only interested in dirtying lineboxes to which we may attach the float.
+                        bool ancestorLineBoxWasDirty = ancestorLineBoxDirty();
+                        setAncestorLineBoxDirty(false);
+                        dirtyLinesFromChangedChild(box);
+                        setAncestorLineBoxDirty(ancestorLineBoxWasDirty);

[eae, 2016/06/10 06:20:41]

Shouldn't this be setAncestorLineBoxDirty(ancestorLineBoxWasDirty ||
ancestorLineBoxDirty())?

[rhogan, 2016/06/10 17:25:13]

Oh I have it the wrong way round. I need to set it to true before calling
dirtyLinesFromChangedChild, as I want to avoid climbing up the trees.

But when I reset it after calling dirtyLinesFromChangedChild() I do want to set
it back to whatever it was.

Can you take another look at the updated patch?

                     }
                 } else if (isFullLayout || o->needsLayout()) {
                     // Atomic inline.