Dirty line boxes correctly when a float gets layout

third_party/WebKit/Source/core/layout/line/LineBoxList.cpp

Index: third_party/WebKit/Source/core/layout/line/LineBoxList.cpp
diff --git a/third_party/WebKit/Source/core/layout/line/LineBoxList.cpp b/third_party/WebKit/Source/core/layout/line/LineBoxList.cpp
index 045661e60448b806b255d3d0a5f49ea37004351b..1d20447074624a889df9d6e8b720cf52ab886162 100644
--- a/third_party/WebKit/Source/core/layout/line/LineBoxList.cpp
+++ b/third_party/WebKit/Source/core/layout/line/LineBoxList.cpp
@@ -228,7 +228,7 @@ bool LineBoxList::hitTest(LineLayoutBoxModel layoutObject, HitTestResult& result
     return false;
 }
 
-void LineBoxList::dirtyLinesFromChangedChild(LineLayoutItem container, LineLayoutItem child)
+void LineBoxList::dirtyLinesFromChangedChild(LineLayoutItem container, LineLayoutItem child, bool canDirtyAncestors)
 {
     if (!container.parent() || (container.isLayoutBlock() && (container.selfNeedsLayout() || !container.isLayoutBlockFlow())))
         return;
@@ -240,7 +240,7 @@ void LineBoxList::dirtyLinesFromChangedChild(LineLayoutItem container, LineLayou
     if (!firstBox) {
         // For an empty inline, go ahead and propagate the check up to our parent, unless the parent
         // is already dirty.
-        if (container.isInline() && !container.ancestorLineBoxDirty()) {
+        if (container.isInline() && !container.ancestorLineBoxDirty() && canDirtyAncestors) {
             container.parent().dirtyLinesFromChangedChild(container);
             container.setAncestorLineBoxDirty(); // Mark the container to avoid dirtying the same lines again across multiple destroy() calls of the same subtree.
         }
@@ -280,7 +280,7 @@ void LineBoxList::dirtyLinesFromChangedChild(LineLayoutItem container, LineLayou
             // we won't find a previous sibling, but firstBox can be pointing to a following sibling.
             // This isn't good enough, since we won't locate the root line box that encloses the removed
             // <br>. We have to just over-invalidate a bit and go up to our parent.
-            if (!inlineContainer.ancestorLineBoxDirty()) {
+            if (!inlineContainer.ancestorLineBoxDirty() && canDirtyAncestors) {
                 inlineContainer.parent().dirtyLinesFromChangedChild(inlineContainer);
                 inlineContainer.setAncestorLineBoxDirty(); // Mark the container to avoid dirtying the same lines again across multiple destroy() calls of the same subtree.
             }