Strip anonymous blocks when change in style removes need for them

Source/core/rendering/RenderBlock.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2007 David Smith (catfish.man@gmail.com)
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) Research In Motion Limited 2010. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 326 matching lines @@
     return oldStyle->borderTopWidth() != newStyle->borderTopWidth()
         || oldStyle->borderBottomWidth() != newStyle->borderBottomWidth()
         || oldStyle->paddingTop() != newStyle->paddingTop()
         || oldStyle->paddingBottom() != newStyle->paddingBottom();
 }
 
 void RenderBlock::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
 {
     RenderBox::styleDidChange(diff, oldStyle);
 
+    if (isFloatingOrOutOfFlowPositioned() && oldStyle && !oldStyle->isFloating() && !oldStyle->hasOutOfFlowPosition() && parent() && parent()->isRenderBlockFlow())
+        toRenderBlock(parent())->removeAnonymousWrappersIfRequired();
+
     RenderStyle* newStyle = style();
 
     if (!isAnonymousBlock()) {
         // Ensure that all of our continuation blocks pick up the new style.
         for (RenderBlock* currCont = blockElementContinuation(); currCont; currCont = currCont->blockElementContinuation()) {
             RenderBoxModelObject* nextCont = currCont->continuation();
             currCont->setContinuation(0);
             currCont->setStyle(newStyle);
             currCont->setContinuation(nextCont);
         }
@@ skipping 736 matching lines @@
         return false;
 
     if (!prev || !next)
         return true;
 
     // Make sure the types of the anonymous blocks match up.
     return prev->isAnonymousColumnsBlock() == next->isAnonymousColumnsBlock()
            && prev->isAnonymousColumnSpanBlock() == next->isAnonymousColumnSpanBlock();
 }
 
+void RenderBlock::removeAnonymousWrappersIfRequired()
+{
+    ASSERT(isRenderBlockFlow());
+    Vector<RenderBox*, 16> blocksToRemove;
+    for (RenderBox* child = firstChildBox(); child; child = child->nextSiblingBox()) {
+        // There are still block children in the container, so any anonymous wrappers are still needed.
+        if (!child->isAnonymousBlock() && !child->isFloatingOrOutOfFlowPositioned())
+            return;
+        // We can't remove anonymous wrappers if they contain continuations as this means there are block children present.
+        if (child->isRenderBlock() && toRenderBlock(child)->continuation())
+            return;
+        // We are only interested in removing anonymous wrappers if there are inline siblings underneath them.
+        if (!child->childrenInline())

[rhogan, 2014/11/10 19:22:57]

This addresses the cause of the clusterfuzz crashes that forced me to revert my
last attempt.

+            return;
+        if (child->isAnonymousBlock())
+            blocksToRemove.append(child);
+    }
+
+    for (size_t i = 0; i < blocksToRemove.size(); i++)
+        collapseAnonymousBlockChild(this, toRenderBlock(blocksToRemove[i]));
+}
+
 void RenderBlock::collapseAnonymousBlockChild(RenderBlock* parent, RenderBlock* child)
 {
     // It's possible that this block's destruction may have been triggered by the
     // child's removal. Just bail if the anonymous child block is already being
     // destroyed. See crbug.com/282088
     if (child->beingDestroyed())
         return;
     parent->setNeedsLayoutAndPrefWidthsRecalcAndFullPaintInvalidation();
     parent->setChildrenInline(child->childrenInline());
     RenderObject* nextSibling = child->nextSibling();
@@ skipping 3248 matching lines @@
 void RenderBlock::showLineTreeAndMark(const InlineBox* markedBox1, const char* markedLabel1, const InlineBox* markedBox2, const char* markedLabel2, const RenderObject* obj) const
 {
     showRenderObject();
     for (const RootInlineBox* root = firstRootBox(); root; root = root->nextRootBox())
         root->showLineTreeAndMark(markedBox1, markedLabel1, markedBox2, markedLabel2, obj, 1);
 }
 
 #endif
 
 } // namespace blink