[css-grid] Fix crash removing positioned grid item

third_party/WebKit/Source/core/layout/LayoutGrid.cpp

 /*
  * Copyright (C) 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 53 matching lines @@
 
 LayoutGrid* LayoutGrid::createAnonymous(Document* document) {
   LayoutGrid* layoutGrid = new LayoutGrid(nullptr);
   layoutGrid->setDocumentForAnonymous(document);
   return layoutGrid;
 }
 
 void LayoutGrid::addChild(LayoutObject* newChild, LayoutObject* beforeChild) {
   LayoutBlock::addChild(newChild, beforeChild);
 
-  // The grid needs to be recomputed as it might contain auto-placed items that
-  // will change their position.
-  dirtyGrid();
+  if (!newChild->isOutOfFlowPositioned()) {

[jfernandez, 2017/03/15 09:26:36]

I think it'd be useful to add comment explaining why we don't need to mark the
grid as dirty in this case.

[Manuel Rego, 2017/03/15 10:59:26]

Done.

+    // The grid needs to be recomputed as it might contain auto-placed items
+    // that will change their position.
+    dirtyGrid();
+  }

[svillar, 2017/03/15 10:03:54]

Better to early return

if (newChild->isOutOfFlowPositioned)
   return;

[Manuel Rego, 2017/03/15 10:59:26]

Acknowledged.

 }
 
 void LayoutGrid::removeChild(LayoutObject* child) {
   LayoutBlock::removeChild(child);
 
-  // The grid needs to be recomputed as it might contain auto-placed items that
-  // will change their position.
-  dirtyGrid();
+  if (!child->isOutOfFlowPositioned()) {
+    // The grid needs to be recomputed as it might contain auto-placed items
+    // that will change their position.
+    dirtyGrid();
+  }

[svillar, 2017/03/15 10:03:54]

Ditto.

[Manuel Rego, 2017/03/15 10:59:26]

Acknowledged.

 }
 
 void LayoutGrid::styleDidChange(StyleDifference diff,
                                 const ComputedStyle* oldStyle) {
   LayoutBlock::styleDidChange(diff, oldStyle);
   if (!oldStyle)
     return;
 
   // FIXME: The following checks could be narrowed down if we kept track of
   // which type of grid items we have:
@@ skipping 1996 matching lines @@
   if (direction == ForRows)
     return grid.numTracks(ForRows);
 
   return grid.numTracks(ForRows)
              ? grid.numTracks(ForColumns)
              : GridPositionsResolver::explicitGridColumnCount(
                    styleRef(), grid.autoRepeatTracks(ForColumns));
 }
 
 }  // namespace blink