[css-grid] Fix crash removing positioned grid item

third_party/WebKit/Source/core/layout/LayoutGrid.cpp

 /*
  * Copyright (C) 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 58 matching lines @@
 
 LayoutGrid* LayoutGrid::createAnonymous(Document* document) {
   LayoutGrid* layoutGrid = new LayoutGrid(nullptr);
   layoutGrid->setDocumentForAnonymous(document);
   return layoutGrid;
 }
 
 void LayoutGrid::addChild(LayoutObject* newChild, LayoutObject* beforeChild) {
   LayoutBlock::addChild(newChild, beforeChild);
 
+  // Positioned grid items do not take up space or otherwise participate in the
+  // layout of the grid, for that reason we don't need to mark the grid as dirty
+  // when they are added.
+  if (newChild->isOutOfFlowPositioned())
+    return;
+
   // The grid needs to be recomputed as it might contain auto-placed items that
   // will change their position.
   dirtyGrid();
 }
 
 void LayoutGrid::removeChild(LayoutObject* child) {
   LayoutBlock::removeChild(child);
 
+  // Positioned grid items do not take up space or otherwise participate in the
+  // layout of the grid, for that reason we don't need to mark the grid as dirty
+  // when they are removed.
+  if (child->isOutOfFlowPositioned())
+    return;
+
   // The grid needs to be recomputed as it might contain auto-placed items that
   // will change their position.
   dirtyGrid();
 }
 
 void LayoutGrid::styleDidChange(StyleDifference diff,
                                 const ComputedStyle* oldStyle) {
   LayoutBlock::styleDidChange(diff, oldStyle);
   if (!oldStyle)
     return;
@@ skipping 1998 matching lines @@
   if (direction == ForRows)
     return grid.numTracks(ForRows);
 
   return grid.numTracks(ForRows)
              ? grid.numTracks(ForColumns)
              : GridPositionsResolver::explicitGridColumnCount(
                    styleRef(), grid.autoRepeatTracks(ForColumns));
 }
 
 }  // namespace blink