Womo Adventure Map Full Screen View is not loading properly

https://bugs.webkit.org/show_bug.cgi?id=259570
<rdar://112733052>

Reviewed by Simon Fraser.

Let's just invalidate the floats as intended (and not floats _and_ out-of-flow positioned boxes).

1. out-of-flow box is incorrectly removed from the descendent map on the containing block (in clearDescendantFloats)
2. mutation on the out-of-flow box marks the containing block dirty with "simplified layout is needed"
3. simplified layout is triggered -> out-of-flow box is missing from the map (simplified layout is not supposed to re-populate this map).
-> out-of-flow box stays dirty

* LayoutTests/fast/dynamic/float-containing-block-becomes-out-of-flow-expected.html: Added.
* LayoutTests/fast/dynamic/float-containing-block-becomes-out-of-flow.html: Added.
* Source/WebCore/rendering/RenderBox.cpp:
(WebCore::RenderBox::removeFloatingAndInvalidateForLayout):
(WebCore::RenderBox::removeFloatingOrPositionedChildFromBlockLists):
* Source/WebCore/rendering/RenderBox.h:
* Source/WebCore/rendering/updating/RenderTreeBuilder.cpp:
(WebCore::RenderTreeBuilder::normalizeTreeAfterStyleChange):

Canonical link: https://commits.webkit.org/266366@main

LayoutTests/fast/dynamic/float-containing-block-becomes-out-of-flow-expected.html

@@ -0,0 +1,11 @@
+<style>
+.container {
+  font-family: monospace;
+  position: fixed;
+}
+.parent {
+  background-color: green;
+  position: absolute
+}
+</style>
+<div class=container><div class=parent>PASS if this text is visible</div></div>

LayoutTests/fast/dynamic/float-containing-block-becomes-out-of-flow.html

@@ -0,0 +1,31 @@
+<style>
+#container {
+  float: left;
+  font-family: monospace;
+}
+.parent {
+  position: relative;
+}
+#mutate_this {
+  position: absolute;
+  background-color: green;
+}
+#remove_this {
+  display: inline-block;
+}
+</style>
+<div id=container>
+  <div class=parent>
+    <div id=mutate_this>
+      <div id=remove_this></div>
+    </div>
+  </div>
+</div>
+<script>
+document.body.offsetHeight;
+container.style.position = "fixed";
+remove_this.remove();
+
+document.body.offsetHeight;
+mutate_this.appendChild(document.createTextNode("PASS if this text is visible"));
+</script>

Source/WebCore/rendering/RenderBox.cpp

@@ -254,19 +254,28 @@ static RenderBlockFlow* outermostBlockContainingFloatingObject(RenderBox& box)
     return parentBlock;
 }
 
+void RenderBox::removeFloatingAndInvalidateForLayout()
+{
+    ASSERT(isFloating());
+
+    if (renderTreeBeingDestroyed())
+        return;
+
+    if (auto* ancestor = outermostBlockContainingFloatingObject(*this)) {
+        ancestor->markSiblingsWithFloatsForLayout(this);
+        ancestor->markAllDescendantsWithFloatsForLayout(this, false);
+    }
+}
+
 void RenderBox::removeFloatingOrPositionedChildFromBlockLists()
 {
     ASSERT(isFloatingOrOutOfFlowPositioned());
 
     if (renderTreeBeingDestroyed())
         return;
 
-    if (isFloating()) {
-        if (RenderBlockFlow* parentBlock = outermostBlockContainingFloatingObject(*this)) {
-            parentBlock->markSiblingsWithFloatsForLayout(this);
-            parentBlock->markAllDescendantsWithFloatsForLayout(this, false);
-        }
-    }
+    if (isFloating())
+        removeFloatingAndInvalidateForLayout();
 
     if (isOutOfFlowPositioned())
         RenderBlock::removePositionedObject(*this);

Source/WebCore/rendering/RenderBox.h

@@ -526,6 +526,7 @@ class RenderBox : public RenderBoxModelObject {
 
     VisiblePosition positionForPoint(const LayoutPoint&, const RenderFragmentContainer*) override;
 
+    void removeFloatingAndInvalidateForLayout();
     void removeFloatingOrPositionedChildFromBlockLists();
 
     RenderLayer* enclosingFloatPaintingLayer() const;

Source/WebCore/rendering/updating/RenderTreeBuilder.cpp

@@ -647,8 +647,8 @@ void RenderTreeBuilder::normalizeTreeAfterStyleChange(RenderElement& renderer, R
             auto clearDescendantFloats = [&] {
                 // These descendent floats can not intrude other, sibling block containers anymore.
                 for (auto& descendant : descendantsOfType<RenderBox>(renderer)) {
-                    if (descendant.isFloatingOrOutOfFlowPositioned())
-                        descendant.removeFloatingOrPositionedChildFromBlockLists();
+                    if (descendant.isFloating())
+                        descendant.removeFloatingAndInvalidateForLayout();
                 }
             };
             clearDescendantFloats();