[LayoutNG] Invalidate inline items recursively when moved

CL:1056647 invalidated inline items in LayoutNGText when
LayoutObjects are moved without full notifications.

However, it did not handle when LayoutInline is moved and it
has LayoutNGText descendants. In such cases, InsertChildNode
is called only for the LayoutInline. This patch supports the
case as well.

Bug: 636993
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_layout_tests_layout_ng
Change-Id: I9aaefec24f3dd67f9d3b257af35e079d07418b71
Reviewed-on: https://chromium-review.googlesource.com/1065540Reviewed-by: Emil A Eklund <eae@chromium.org>
Commit-Queue: Emil A Eklund <eae@chromium.org>
Cr-Commit-Position: refs/heads/master@{#560305}

third_party/WebKit/LayoutTests/FlagExpectations/enable-blink-features=LayoutNG

@@ -39,11 +39,7 @@ crbug.com/714962 external/wpt/css/css-transforms/transform-abspos-007.html [ Ski
 crbug.com/811429 fast/text/font-format-support-cbdt-sbix-cff2-vertical.html [ Failure ]
 
 # Crashes/asserts/failures due to inline item reuse.
-crbug.com/636993 accessibility/removed-continuation-element-causes-crash.html [ Crash ]
-crbug.com/636993 fast/css/first-letter-removed-added.html [ Crash ]
 crbug.com/591099 fast/css/getComputedStyle/getComputedStyle-resolved-values.html [ Crash ]
-crbug.com/594672 fast/events/updateLayoutForHitTest.html [ Failure ]
-crbug.com/594672 virtual/mouseevent_fractional/fast/events/updateLayoutForHitTest.html [ Failure ]
 
 # New passes
 crbug.com/591099 external/wpt/css/CSS2/floats-clear/no-clearance-adjoining-opposite-float.html [ Pass ]

third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/events/updateLayoutForHitTest-expected.txt

+CONSOLE ERROR: line 36: Uncaught TypeError: Cannot read property 'style' of null
+CONSOLE ERROR: line 40: Uncaught TypeError: Cannot read property 'style' of null
+CONSOLE ERROR: line 36: Uncaught TypeError: Cannot read property 'style' of null
+CONSOLE ERROR: line 40: Uncaught TypeError: Cannot read property 'style' of null
+layer at (0,0) size 800x600
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 800x600
+  LayoutNGBlockFlow {HTML} at (0,0) size 800x600
+    LayoutNGBlockFlow {BODY} at (8,8) size 784x584
+      LayoutNGBlockFlow (floating) {DIV} at (5,5) size 66x30 [bgcolor=#ADD8E6]
+        LayoutInline {SPAN} at (0,0) size 8x19
+          LayoutText {#text} at (5,5) size 8x19
+            text run at (5,5) width 8: "\x{25B8}"
+        LayoutText {#text} at (13,5) size 48x19
+          text run at (13,5) width 48: " Project"
+selection start: position 0 of child 0 {#text} of child 1 {SPAN} of child 3 {DIV} of body
+selection end:   position 8 of child 2 {#text} of child 3 {DIV} of body

third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/virtual/mouseevent_fractional/fast/events/updateLayoutForHitTest-expected.txt

+CONSOLE ERROR: line 36: Uncaught TypeError: Cannot read property 'style' of null
+CONSOLE ERROR: line 40: Uncaught TypeError: Cannot read property 'style' of null
+CONSOLE ERROR: line 36: Uncaught TypeError: Cannot read property 'style' of null
+CONSOLE ERROR: line 40: Uncaught TypeError: Cannot read property 'style' of null
+layer at (0,0) size 800x600
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 800x600
+  LayoutNGBlockFlow {HTML} at (0,0) size 800x600
+    LayoutNGBlockFlow {BODY} at (8,8) size 784x584
+      LayoutNGBlockFlow (floating) {DIV} at (5,5) size 66x30 [bgcolor=#ADD8E6]
+        LayoutInline {SPAN} at (0,0) size 8x19
+          LayoutText {#text} at (5,5) size 8x19
+            text run at (5,5) width 8: "\x{25B8}"
+        LayoutText {#text} at (13,5) size 48x19
+          text run at (13,5) width 48: " Project"
+selection start: position 0 of child 0 {#text} of child 1 {SPAN} of child 3 {DIV} of body
+selection end:   position 8 of child 2 {#text} of child 3 {DIV} of body

third_party/blink/renderer/core/layout/layout_object_child_list.cc

@@ -28,6 +28,7 @@
 
 #include "third_party/blink/renderer/core/dom/ax_object_cache.h"
 #include "third_party/blink/renderer/core/layout/layout_counter.h"
+#include "third_party/blink/renderer/core/layout/layout_inline.h"
 #include "third_party/blink/renderer/core/layout/layout_object.h"
 #include "third_party/blink/renderer/core/layout/layout_view.h"
 #include "third_party/blink/renderer/core/layout/ng/inline/layout_ng_text.h"
@@ -35,6 +36,27 @@
 
 namespace blink {
 
+namespace {
+
+// Invalidate InineItems() in LayoutNGText.
+//
+// They need to be invalidated when moving across inline formatting context
+// (i.e., to a different LayoutBlockFlow.)
+void InvalidateInlineItems(LayoutObject* object) {
+  if (object->IsLayoutNGText()) {
+    ToLayoutNGText(object)->InvalidateInlineItems();
+  } else if (object->IsLayoutInline()) {
+    // When moving without |notify_layout_object|, only top-level objects are
+    // moved. Ensure to invalidate all LayoutNGText in this inline formatting
+    // context.
+    for (LayoutObject* curr = object->SlowFirstChild(); curr;
+         curr = curr->NextSibling())
+      InvalidateInlineItems(curr);
+  }
+}
+
+}  // namespace
+
 void LayoutObjectChildList::DestroyLeftoverChildren() {
   while (FirstChild()) {
     // List markers are owned by their enclosing list and so don't get destroyed
@@ -172,11 +194,11 @@ void LayoutObjectChildList::InsertChildNode(LayoutObject* owner,
     if (notify_layout_object) {
       new_child->InsertedIntoTree();
       LayoutCounter::LayoutObjectSubtreeAttached(new_child);
-    } else if (new_child->IsLayoutNGText()) {
+    } else if (RuntimeEnabledFeatures::LayoutNGEnabled()) {
       // |notify_layout_object| is an optimization to skip notifications when
       // moving within the same tree. Inline items need to be invalidated even
       // when moving.
-      ToLayoutNGText(new_child)->InvalidateInlineItems();
+      InvalidateInlineItems(new_child);
     }
   }