Search the entire subtree when looking for the end of an inline continuation chain.

third_party/WebKit/Source/core/layout/LayoutInline.cpp

Index: third_party/WebKit/Source/core/layout/LayoutInline.cpp
diff --git a/third_party/WebKit/Source/core/layout/LayoutInline.cpp b/third_party/WebKit/Source/core/layout/LayoutInline.cpp
index 0ca9f0c68c9b5df3ea98a2f5e951b0b7f8a226a5..6992af87ed788db430c335b0b0f57aac83a045ff 100644
--- a/third_party/WebKit/Source/core/layout/LayoutInline.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutInline.cpp
@@ -1140,11 +1140,17 @@ LayoutRect LayoutInline::absoluteVisualRect() const {
   for (LayoutBlock* currBlock = containingBlock();
        currBlock && currBlock->isAnonymousBlock();
        currBlock = toLayoutBlock(currBlock->nextSibling())) {
+    bool walkChildrenOnly = !currBlock->childrenInline();
     for (LayoutObject* curr = currBlock->firstChild(); curr;
          curr = curr->nextSibling()) {
       LayoutRect rect(curr->localVisualRect());
       context(FloatRect(rect));
-      if (curr == endContinuation) {
+      if (walkChildrenOnly)
+        continue;
+      for (LayoutObject* walker = curr; walker;
+           walker = walker->nextInPreOrder(curr)) {

[rhogan, 2017/03/07 19:01:50]

Nested inside for (LayoutObject* curr = currBlock->firstChild(); curr; curr =
curr->nextSibling()) it seems like this might lead us to visit
curr->nextSibling() more than once. Or are we always certain to hit our target
inside this nested loop?

[mstensho (USE GERRIT), 2017/03/07 19:45:13]

nextInPreOrder(curr) forces us to stay within |curr| here. The method will
return nullptr instead of walking to |curr|'s sibling, when it's done with the
subtree.
No. Come to think of it, we could probably skip this subtree walk when
processing the first object returned from inlineElementContinuation(). Since we
have established that we're in a continuation chain, the end shouldn't be found
at the first object. But I'm not sure if I dare to do this. :)

[rhogan, 2017/03/07 20:00:31]

Oh right enough, the nested loop will always bail unless curr has a
slowFirstChild.
:)

lgtm

+        if (walker != endContinuation)
+          continue;
         LayoutRect rect(enclosingIntRect(floatResult));
         mapToVisualRectInAncestorSpace(view(), rect);
         return rect;