Cherry-pick 8922f7c. rdar://problem/109538333

    (REGRESSION 262148@main) No repaint when deleting text, possibly only when the deleted text spans more than one line
    https://bugs.webkit.org/show_bug.cgi?id=257043
    <rdar://109538333>

    Reviewed by Antti Koivisto.

    Normally while editing inline content in a content-editable container e.g

      "This is some long
       long long long
       long text content"

      and select/delete "long long text" (spanning over line#2 and #3)

    What happens is RenderText receives a content mutation event pointing to the _beginning_ of "long long text".
    As a result we damage line #2 and run a partial layout staring from line#2 until after we see no layout change anymore or we hit content end.

    However some JS based editors call innerHTML instead to mimic editing steps turning the above example to a "range replace"
    type of mutation where the entire text content is getting replaced with the "new", shortened content.

    In such cases, instead of receiving the position of the actual damage, we end up with the offset value of 0
    since the entire content is being replaced (even though it's just a slight change in the text content)
    Now we damage line#0 and start running layout from the very first line until we see no layout change...which is the second line
    since the actual damage is on the third line.

    Since IFC does not support such mutations yet, in this patch we disable range based bailout which means while
    we still run partial inline layout, we always go all the way to the bottom of the content.

    /fast/inline/range-replace-partial-layout-invalidation-expected.html: Added.
    * LayoutTests/fast/inline/range-replace-partial-layout-invalidation.html: Added.
    * Source/WebCore/layout/formattingContexts/inline/invalidation/InlineInvalidation.cpp:
    (WebCore::Layout::InlineInvalidation::textWillBeRemoved):

    Canonical link: https://commits.webkit.org/264274@main

Identifier: 263769.42@safari-7616.1.14.10-branch

LayoutTests/fast/inline/range-replace-partial-layout-invalidation-expected.html

@@ -0,0 +1,6 @@
+<style>
+div {
+  width: 100px;
+}
+</style>
+<div id=focus_this>this is some text and should not ASSERT focused</div>

LayoutTests/fast/inline/range-replace-partial-layout-invalidation.html

@@ -0,0 +1,10 @@
+<style>
+div {
+  width: 100px;
+}
+</style>
+<div id=focus_this>this is some text and should not ASSERT when focused</div>
+<script>
+document.body.offsetHeight;
+focus_this.innerHTML = "this is some text and should not ASSERT focused";
+</script>

Source/WebCore/layout/formattingContexts/inline/invalidation/InlineInvalidation.cpp

@@ -369,7 +369,7 @@ bool InlineInvalidation::textWillBeRemoved(const InlineTextBox& damagedInlineTex
         return false;
 
     auto damagedLine = leadingInlineItemPositionByDamagedBox({ damagedInlineTextBox, offset.value_or(0), DamagedContent::Type::Removal }, m_inlineItems, displayBoxes());
-    updateInlineDamage(!damagedLine ? InlineDamage::Type::Invalid : InlineDamage::Type::NeedsContentUpdateAndLineLayout, damagedLine, ShouldApplyRangeLayout::Yes);
+    updateInlineDamage(!damagedLine ? InlineDamage::Type::Invalid : InlineDamage::Type::NeedsContentUpdateAndLineLayout, damagedLine, ShouldApplyRangeLayout::No);
     return damagedLine.has_value();
 }