Strip anonymous blocks when change in style removes need for them

Source/core/rendering/RenderBlock.cpp

Index: Source/core/rendering/RenderBlock.cpp
diff --git a/Source/core/rendering/RenderBlock.cpp b/Source/core/rendering/RenderBlock.cpp
index 2604be6e70be9b2c8f0059ad47f3d9cd4ea90254..ade432cd370d837aab9222533df6e2e37b3fc91d 100644
--- a/Source/core/rendering/RenderBlock.cpp
+++ b/Source/core/rendering/RenderBlock.cpp
@@ -344,6 +344,9 @@ void RenderBlock::styleDidChange(StyleDifference diff, const RenderStyle* oldSty
 {
     RenderBox::styleDidChange(diff, oldStyle);
 
+    if (isFloatingOrOutOfFlowPositioned() && oldStyle && !oldStyle->isFloating() && !oldStyle->hasOutOfFlowPosition() && parent() && parent()->isRenderBlockFlow())
+        toRenderBlock(parent())->removeAnonymousWrappersIfRequired();
+
     RenderStyle* newStyle = style();
 
     if (!isAnonymousBlock()) {
@@ -1100,6 +1103,28 @@ static bool canMergeContiguousAnonymousBlocks(RenderObject* oldChild, RenderObje
            && prev->isAnonymousColumnSpanBlock() == next->isAnonymousColumnSpanBlock();
 }
 
+void RenderBlock::removeAnonymousWrappersIfRequired()
+{
+    ASSERT(isRenderBlockFlow());
+    Vector<RenderBox*, 16> blocksToRemove;
+    for (RenderBox* child = firstChildBox(); child; child = child->nextSiblingBox()) {
+        // There are still block children in the container, so any anonymous wrappers are still needed.
+        if (!child->isAnonymousBlock() && !child->isFloatingOrOutOfFlowPositioned())
+            return;
+        // We can't remove anonymous wrappers if they contain continuations as this means there are block children present.
+        if (child->isRenderBlock() && toRenderBlock(child)->continuation())
+            return;
+        // We are only interested in removing anonymous wrappers if there are inline siblings underneath them.
+        if (!child->childrenInline())

[rhogan, 2014/11/10 19:22:57]

This addresses the cause of the clusterfuzz crashes that forced me to revert my
last attempt.

+            return;
+        if (child->isAnonymousBlock())
+            blocksToRemove.append(child);
+    }
+
+    for (size_t i = 0; i < blocksToRemove.size(); i++)
+        collapseAnonymousBlockChild(this, toRenderBlock(blocksToRemove[i]));
+}
+
 void RenderBlock::collapseAnonymousBlockChild(RenderBlock* parent, RenderBlock* child)
 {
     // It's possible that this block's destruction may have been triggered by the