[IFC][Partial layout] ASSERT_NOT_REACHED in handleEnterExitBidiContex…

…t with inconsistent InlineBoxStart/End pairs

https://bugs.webkit.org/show_bug.cgi?id=271428
<rdar://125202336>

Reviewed by Antti Koivisto.

Partial layout triggered by pagination may initiate incremental inline item (re)building on non-yet-supported content.
Let's just do full rebuild for now.

* LayoutTests/fast/text/partial-layout-with-pagination-and-widow-expected.txt: Added.
* LayoutTests/fast/text/partial-layout-with-pagination-and-widow.html: Added.
* Source/WebCore/layout/formattingContexts/inline/InlineFormattingContext.cpp:
(WebCore::Layout::InlineFormattingContext::rebuildInlineItemListIfNeeded):

Canonical link: https://commits.webkit.org/276625@main

LayoutTests/fast/text/partial-layout-with-pagination-and-widow-expected.txt

@@ -0,0 +1,7 @@
+
+
+PASS if no crash.
+
+
+
+

LayoutTests/fast/text/partial-layout-with-pagination-and-widow.html

@@ -0,0 +1,35 @@
+<style>
+#container {
+  text-indent: 200px each-line;
+  white-space: pre;
+  widows: 1;
+}
+
+.writing-mode { 
+  height: 102px;
+  writing-mode: tb-rl;
+}
+
+*:nth-last-child(1) {
+  -webkit-column-span: all;
+}
+
+*:read-only {
+  -webkit-user-modify: read-write;
+  padding: 10px;
+  column-width: 100px;
+}
+</style>
+<span id=container><b class=writing-mode dir="auto">
+<span style="unicode-bidi: isolate">
+PASS if no crash.
+</span>
+</b>
+<span></span>
+<script>
+if (window.testRunner)
+  testRunner.dumpAsText();
+document.dir = "rtl";
+window.getSelection().selectAllChildren(container);
+document.execCommand("justifyLeft", false, null);
+</script>

Source/WebCore/layout/formattingContexts/inline/InlineFormattingContext.cpp

@@ -521,8 +521,22 @@ bool InlineFormattingContext::rebuildInlineItemListIfNeeded(const InlineDamage*
     if (!inlineItemListNeedsUpdate)
         return false;
 
-    auto needsLayoutStartPosition = !lineDamage || !lineDamage->layoutStartPosition() ? InlineItemPosition() : lineDamage->layoutStartPosition()->inlineItemPosition;
-    InlineItemsBuilder { inlineContentCache, root(), m_layoutState.securityOrigin() }.build(needsLayoutStartPosition);
+    auto startPositionForInlineItemsBuilding = [&]() -> InlineItemPosition {
+        if (!lineDamage) {
+            ASSERT(inlineContentCache.inlineItems().isEmpty());
+            return { };
+        }
+        if (auto startPosition = lineDamage->layoutStartPosition()) {
+            if (lineDamage->reasons().contains(InlineDamage::Reason::Pagination)) {
+                // FIXME: We don't support partial rebuild with certain types of content. Let's just re-collect inline items.
+                return { };
+            }
+            return startPosition->inlineItemPosition;
+        }
+        // Unsupported damage. Need to run full build/layout.
+        return { };
+    };
+    InlineItemsBuilder { inlineContentCache, root(), m_layoutState.securityOrigin() }.build(startPositionForInlineItemsBuilding());
     return true;
 }