Ensure the text autosizer creates a root cluster when needed

The text autosizer demarcates certain nodes as "clusters" that autosize
using a consistent font multiplier (see http://tinyurl.com/TextAutosizer
for a full description). Clusters can nest forming a tree, and a root
cluster is assumed to be available to all Nodes except the LayoutView.

This patch fixes a bug where no root cluster was created by a LayoutView
which contained LayoutObject children (in this case, a sole pagination
anonymous block) but no Node children. A similar situation can occur
with completely empty documents.

Asserts & comments have been added to clarify the root cluster concept.

BUG=521657

Review URL: https://codereview.chromium.org/1308693003

git-svn-id: svn://svn.chromium.org/blink/trunk@201172 bbb929c8-8fbe-4397-9dbb-9b2b20218538

third_party/WebKit/LayoutTests/fast/text-autosizing/anonymous-block-crash-expected.txt

+

third_party/WebKit/LayoutTests/fast/text-autosizing/anonymous-block-crash.html

+Test for crbug.com/521657: This test passes if it does not crash.
+<script>
+if (window.testRunner)
+    testRunner.dumpAsText();
+internals.settings.setTextAutosizingEnabled(true);
+internals.settings.setTextAutosizingWindowSizeOverride(320, 480);
+
+document.documentElement.style.overflow = '-webkit-paged-x';
+onload = function() {
+    var forceLayout = document.body.offsetTop;
+    document.documentElement.parentNode.removeChild(document.documentElement);
+}
+</script>
\ No newline at end of file

third_party/WebKit/Source/core/layout/TextAutosizer.cpp

@@ -143,13 +143,17 @@ static bool isPotentialClusterRoot(const LayoutObject* layoutObject)
 {
     // "Potential cluster roots" are the smallest unit for which we can
     // enable/disable text autosizing.
+    // - Must have children.
+    //   An exception is made for LayoutView which should create a root to
+    //   maintain consistency with documents that have no child nodes but may
+    //   still have LayoutObject children.
     // - Must not be inline, as different multipliers on one line looks terrible.
     //   Exceptions are inline-block and alike elements (inline-table, -webkit-inline-*),
     //   as they often contain entire multi-line columns of text.
     // - Must not be normal list items, as items in the same list should look
     //   consistent, unless they are floating or position:absolute/fixed.
     Node* node = layoutObject->generatingNode();
-    if (node && !node->hasChildren())
+    if (node && !node->hasChildren() && !layoutObject->isLayoutView())
         return false;
     if (!layoutObject->isLayoutBlock())
         return false;
@@ -315,7 +319,7 @@ void TextAutosizer::destroy(const LayoutBlock* block)
         // LayoutBlock with a fingerprint was destroyed during layout.
         // Clear the cluster stack and the supercluster map to avoid stale pointers.
         // Speculative fix for http://crbug.com/369485.
-        m_firstBlockToBeginLayout = 0;
+        m_firstBlockToBeginLayout = nullptr;
         m_clusterStack.clear();
         m_superclusters.clear();
     }
@@ -362,9 +366,13 @@ void TextAutosizer::beginLayout(LayoutBlock* block)
     if (prepareForLayout(block) == StopLayout)
         return;
 
+    ASSERT(!m_clusterStack.isEmpty() || block->isLayoutView());
+
     if (Cluster* cluster = maybeCreateCluster(block))
         m_clusterStack.append(adoptPtr(cluster));
 
+    ASSERT(!m_clusterStack.isEmpty());
+
     // Cells in auto-layout tables are handled separately by inflateAutoTable.
     bool isAutoTableCell = block->isTableCell() && !toLayoutTableCell(block)->table()->style()->isFixedTableLayout();
     if (!isAutoTableCell && !m_clusterStack.isEmpty())
@@ -404,7 +412,7 @@ void TextAutosizer::endLayout(LayoutBlock* block)
     ASSERT(shouldHandleLayout());
 
     if (block == m_firstBlockToBeginLayout) {
-        m_firstBlockToBeginLayout = 0;
+        m_firstBlockToBeginLayout = nullptr;
         m_clusterStack.clear();
         m_superclusters.clear();
         m_stylesRetainedDuringLayout.clear();