Merge 91781

Source/WebCore/rendering/RenderLineBoxList.cpp

 /*
  * Copyright (C) 2008 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 336 matching lines @@
                 box = textBox->root();
         } else if (curr->isRenderInline()) {
             InlineBox* lastSiblingBox = toRenderInline(curr)->lastLineBoxIncludingCulling();
             if (lastSiblingBox)
                 box = lastSiblingBox->root();
         }
 
         if (box)
             break;
     }
-    if (!box)
+    if (!box) {
+        if (inlineContainer && !inlineContainer->alwaysCreateLineBoxes()) {
+            // https://bugs.webkit.org/show_bug.cgi?id=60778
+            // We may have just removed a <br> with no line box that was our first child. In this case
+            // we won't find a previous sibling, but firstBox can be pointing to a following sibling.
+            // This isn't good enough, since we won't locate the root line box that encloses the removed
+            // <br>. We have to just over-invalidate a bit and go up to our parent.
+            if (!inlineContainer->parent()->selfNeedsLayout()) {
+                inlineContainer->parent()->dirtyLinesFromChangedChild(inlineContainer);
+                inlineContainer->setNeedsLayout(true); // Mark the container as needing layout to avoid dirtying the same lines again across multiple destroy() calls of the same subtree.
+            }
+            return;
+        }
         box = firstBox->root();
+    }
 
     // If we found a line box, then dirty it.
     if (box) {
         RootInlineBox* adjacentBox;
         box->markDirty();
 
         // dirty the adjacent lines that might be affected
         // NOTE: we dirty the previous line because RootInlineBox objects cache
         // the address of the first object on the next line after a BR, which we may be
         // invalidating here.  For more info, see how RenderBlock::layoutInlineChildren
@@ skipping 19 matching lines @@
         ASSERT(child->prevLineBox() == prev);
         prev = child;
     }
     ASSERT(prev == m_lastLineBox);
 #endif
 }
 
 #endif
 
 }