Cherry-pick 272448.102@safari-7618-branch (6d2f579). https://bugs.web…

…kit.org/show_bug.cgi?id=267487

    Invalidate existing inline layout content when simplified out-of-flow is sufficient
    https://bugs.webkit.org/show_bug.cgi?id=267487
    rdar://120496542

    Reviewed by Antti Koivisto.

    Do not leave stale inline content around.

    * LayoutTests/fast/inline/dynamic-inline-content-with-out-of-flow-child-expected.txt: Added.
    * LayoutTests/fast/inline/dynamic-inline-content-with-out-of-flow-child.html: Added.
    * Source/WebCore/rendering/RenderBlockFlow.cpp:
    (WebCore::RenderBlockFlow::layoutModernLines):

    Canonical link: https://commits.webkit.org/272448.102@safari-7618-branch

Canonical link: https://commits.webkit.org/274313.64@webkitglib/2.44

LayoutTests/fast/inline/dynamic-inline-content-with-out-of-flow-child-expected.txt

@@ -0,0 +1,2 @@
+
+PASS if no crash or assert

LayoutTests/fast/inline/dynamic-inline-content-with-out-of-flow-child.html

@@ -0,0 +1,19 @@
+<style>
+img {
+  position: absolute;
+}
+</style>
+<div><img id=img></div>
+<div id=move_here>remove</div>
+<div id=result></div>
+<script>
+if (window.testRunner)
+  testRunner.dumpAsText();
+document.execCommand("selectAll", false);
+let selection = document.getSelection();
+move_here.appendChild(img);
+document.body.offsetHeight;
+selection.deleteFromDocument();
+document.body.offsetHeight;
+result.innerText = "PASS if no crash or assert";
+</script>

Source/WebCore/rendering/RenderBlockFlow.cpp

@@ -4049,6 +4049,8 @@ void RenderBlockFlow::layoutModernLines(bool relayoutChildren, LayoutUnit& repai
 
     if (hasSimpleOutOfFlowContentOnly) {
         // Shortcut the layout.
+        m_lineLayout = std::monostate();
+
         setStaticPositionsForSimpleOutOfFlowContent();
         setLogicalHeight(borderAndPaddingBefore() + borderAndPaddingAfter() + scrollbarLogicalHeight());
         return;