Create FloatingObject from NG Fragment in old Layout tree

third_party/WebKit/Source/core/layout/ng/ng_box.cc

Index: third_party/WebKit/Source/core/layout/ng/ng_box.cc
diff --git a/third_party/WebKit/Source/core/layout/ng/ng_box.cc b/third_party/WebKit/Source/core/layout/ng/ng_box.cc
index 72f3af367574b0289697a268044e420b502fdce1..356bf59423119529b4caf484f8e05500a69e1e78 100644
--- a/third_party/WebKit/Source/core/layout/ng/ng_box.cc
+++ b/third_party/WebKit/Source/core/layout/ng/ng_box.cc
@@ -103,11 +103,19 @@ void NGBox::SetFirstChild(NGBox* child) {
   first_child_ = child;
 }
 
-void NGBox::PositionUpdated() {
+void NGBox::PositionUpdated(LayoutBox* parent) {
   if (layout_box_) {
     layout_box_->setX(fragment_->LeftOffset());
     layout_box_->setY(fragment_->TopOffset());
   }
+
+  if (layout_box_->isFloating() && parent->isLayoutBlockFlow()) {

[cbiesinger, 2016/10/17 21:00:34]

You're accessing layout_box_ without a nullcheck here.

Probably the first nullcheck in this function should just be an early return.

Why do you need the parent argument instead of using layout_box_->parent()?

[Gleb Lanbin, 2016/10/17 22:13:22]

Done.

+    FloatingObject* floating_object =
+        toLayoutBlockFlow(parent)->insertFloatingObject(*layout_box_);
+    floating_object->setX(fragment_->LeftOffset());
+    floating_object->setY(fragment_->TopOffset());
+    floating_object->setIsPlaced(true);
+  }
 }
 
 bool NGBox::CanUseNewLayout() {
@@ -137,7 +145,7 @@ void NGBox::CopyFragmentDataToLayoutBox(
   // LayoutObject tree.
   for (NGBox* box = FirstChild(); box; box = box->NextSibling()) {
     if (box->fragment_)
-      box->PositionUpdated();
+      box->PositionUpdated(layout_box_);
   }
 
   if (layout_box_->isLayoutBlock())