Insert an anonymous inline-table when inserting a table part under an inline.

Insert an anonymous inline-table when inserting a table part under an inline.

The spec says that if the parent of the table part is an inline, we must wrap
it inside an inline-table instead of a table.

Apart from giving correct rendering, this change also helps avoid establishing
(incorrect) inline continuations in some cases.

BUG=327832, 452591, 53693, 2032
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=189941

[mstensho (USE GERRIT), 2015-02-05 07:24:54]

mstensho@opera.com changed reviewers:
+ jchaffraix@chromium.org, leviw@chromium.org

[mstensho (USE GERRIT), 2015-02-05 07:24:55]

While investigating issue 453488, I discovered that inline continuations are
established (so that an anonymous block-level table can be inserted) when
inserting table parts. This is wrong. We should just insert an inline-table
instead. So I fixed that.

Afterwards I went through the BTS to see if this had been reported before, and,
lo and behold! Not only reported, but even attempted fixed (in a very similar
way to the one I'm proposing here, even).

Later on, that fix got reverted, because of use-after-free reported by
ClusterFuzz.

Since I don't have access to any of those use-after-free TCs, there's little I
can do, but attempt to reland this again, and see what ClusterFuzz has for us
this time. It may be that we're lucky, and that the fix for issue 451059 makes
this patch safe (thanks to LayoutTable::addChildIgnoringContinuation()).

But the best thing would obviously be that I got access to the TCs that started
to crash last time this was attempted landed.

[leviw_travelin_and_unemployed, 2015-02-10 21:41:29]

I may have combined some of these similar tests into one, but that's just a
small nit.

Good catch! LGTM!

[mstensho (USE GERRIT), 2015-02-10 22:00:49]

New patchsets have been uploaded after l-g-t-m from leviw@chromium.org

[mstensho (USE GERRIT), 2015-02-10 22:25:51]

On 2015/02/10 21:41:29, leviw wrote:
> I may have combined some of these similar tests into one, but that's just a
> small nit.
> 
> Good catch! LGTM!

Done.

[mstensho (USE GERRIT), 2015-02-10 22:26:03]

The CQ bit was checked by mstensho@opera.com

[commit-bot: I haz the power, 2015-02-10 22:26:30]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/895953003/40001

[commit-bot: I haz the power, 2015-02-10 23:52:39]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2015-02-10 23:52:40]

Try jobs failed on following builders:
  linux_blink_dbg on tryserver.blink (JOB_FAILED,
http://build.chromium.org/p/tryserver.blink/builders/linux_blink_dbg/builds/4...)

[leviw_travelin_and_unemployed, 2015-02-10 23:58:00]

The CQ bit was checked by leviw@chromium.org

[leviw_travelin_and_unemployed, 2015-02-10 23:58:01]

Great! Thanks!

[commit-bot: I haz the power, 2015-02-10 23:58:39]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/895953003/40001

[commit-bot: I haz the power, 2015-02-11 01:15:03]

Committed patchset #3 (id:40001) as
https://src.chromium.org/viewvc/blink?view=rev&revision=189941

[mstensho (USE GERRIT), 2015-02-13 17:33:00]

A revert of this CL (patchset #3 id:40001) has been created in
https://codereview.chromium.org/925823003/ by mstensho@opera.com.

The reason for reverting is: Caused bug 458184, and more. I'll reland a new CL
for this as soon as I figure out how to do so without breaking stuff.

I think what needs to be fixed is to add some logic in RenderInline::addChild()
/ addChildBlahblah(), to drill down to the actual parent of |beforeChild|, if
specified. Looks like anonymous inline-level boxes is a rather unknown concept
in the engine..