Never position a float after it has been placed.

Never position a float after it has been placed.

When a float is marked as "placed" (which happens in
LayoutBlockFlow::placeNewFloats()), it means that it has been added to a float
interval tree. It is not allowed to move a float afterwards (unless we remove
and re-insert the floats somehow, e.g. by re-laying out its containing block).
Otherwise, the interval tree may get out of sync with reality, and we may fail
to find the reference to a FloatingObject in the interval tree when deleting a
FloatingObject, so that we end up deleting the FloatingObject, but not the
reference to it in the interval tree (which will remain there, pointing to a
now dead object).

This could happen when LayoutBlockFlow::removeFloatingObjectsBelow() was called
during pagination. We sometimes need to re-lay out a line because the line or
floats next to the line get pushed to the next fragmentainer. As part of that,
we also need to get rid of the floats that we thought would sit beside the
line, and re-position them.

BUG=670927
Committed: https://crrev.com/2f08e63f7cbb8de6ad0b14c0174a75386a4a2863
Cr-Commit-Position: refs/heads/master@{#436776}

[mstensho (USE GERRIT), 2016-12-06 13:16:00]

The CQ bit was checked by mstensho@opera.com to run a CQ dry run

[commit-bot: I haz the power, 2016-12-06 13:16:18]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[mstensho (USE GERRIT), 2016-12-06 14:30:06]

The CQ bit was checked by mstensho@opera.com to run a CQ dry run

[commit-bot: I haz the power, 2016-12-06 14:30:20]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-12-06 16:52:30]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-12-06 16:52:31]

Dry run: This issue passed the CQ dry run.

[mstensho (USE GERRIT), 2016-12-06 17:02:40]

mstensho@opera.com changed reviewers:
+ eae@chromium.org, szager@chromium.org

[mstensho (USE GERRIT), 2016-12-06 17:02:40]

Simple fix for some float shenanigans I wasn't aware of. So I went ahead
introduced a security bug, it turned out. Scary stuff.

[szager1, 2016-12-06 19:00:01]

lgtm

[mstensho (USE GERRIT), 2016-12-06 23:33:40]

The CQ bit was checked by mstensho@opera.com

[commit-bot: I haz the power, 2016-12-06 23:34:48]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-12-07 00:28:47]

CQ is committing da patch.

Bot data: {"patchset_id": 20001, "attempt_start_ts": 1481067220445380,
"parent_rev": "a8a8acdcf6d8d96cc40a3d4eb95ea53684ee054c", "commit_rev":
"e32c458b6f6b95856447c04b1393e8ed6224579e"}

[commit-bot: I haz the power, 2016-12-07 00:29:14]

Committed patchset #2 (id:20001)

[commit-bot: I haz the power, 2016-12-07 00:32:03]

Description was changed from

==========
Never position a float after it has been placed.

When a float is marked as "placed" (which happens in
LayoutBlockFlow::placeNewFloats()), it means that it has been added to a float
interval tree. It is not allowed to move a float afterwards (unless we remove
and re-insert the floats somehow, e.g. by re-laying out its containing block).
Otherwise, the interval tree may get out of sync with reality, and we may fail
to find the reference to a FloatingObject in the interval tree when deleting a
FloatingObject, so that we end up deleting the FloatingObject, but not the
reference to it in the interval tree (which will remain there, pointing to a
now dead object).

This could happen when LayoutBlockFlow::removeFloatingObjectsBelow() was called
during pagination. We sometimes need to re-lay out a line because the line or
floats next to the line get pushed to the next fragmentainer. As part of that,
we also need to get rid of the floats that we thought would sit beside the
line, and re-position them.

BUG=670927
==========

to

==========
Never position a float after it has been placed.

When a float is marked as "placed" (which happens in
LayoutBlockFlow::placeNewFloats()), it means that it has been added to a float
interval tree. It is not allowed to move a float afterwards (unless we remove
and re-insert the floats somehow, e.g. by re-laying out its containing block).
Otherwise, the interval tree may get out of sync with reality, and we may fail
to find the reference to a FloatingObject in the interval tree when deleting a
FloatingObject, so that we end up deleting the FloatingObject, but not the
reference to it in the interval tree (which will remain there, pointing to a
now dead object).

This could happen when LayoutBlockFlow::removeFloatingObjectsBelow() was called
during pagination. We sometimes need to re-lay out a line because the line or
floats next to the line get pushed to the next fragmentainer. As part of that,
we also need to get rid of the floats that we thought would sit beside the
line, and re-position them.

BUG=670927

Committed: https://crrev.com/2f08e63f7cbb8de6ad0b14c0174a75386a4a2863
Cr-Commit-Position: refs/heads/master@{#436776}
==========

[commit-bot: I haz the power, 2016-12-07 00:32:04]

Patchset 2 (id:??) landed as
https://crrev.com/2f08e63f7cbb8de6ad0b14c0174a75386a4a2863
Cr-Commit-Position: refs/heads/master@{#436776}

[eae, 2016-12-07 07:19:06]

LGTM, thanks Morten!