Cherry-pick 272448.28@safari-7618-branch (2658caa). https://bugs.webk…

…it.org/show_bug.cgi?id=267268

    [IFC] Do not treat out-of-flow line break as text content
    https://bugs.webkit.org/show_bug.cgi?id=267268
    rdar://120662940

    Reviewed by Antti Koivisto.

    Out-of-flow line break is not eligible for simplified (text-only) line building.

    * LayoutTests/fast/text/out-of-flow-line-break-crash-expected.txt: Added.
    * LayoutTests/fast/text/out-of-flow-line-break-crash.html: Added.
    * Source/WebCore/layout/formattingContexts/inline/InlineItemsBuilder.cpp:
    (WebCore::Layout::isTextOrLineBreak):
    * Source/WebCore/layout/formattingContexts/inline/TextOnlySimpleLineBuilder.cpp:
    (WebCore::Layout::TextOnlySimpleLineBuilder::placeNonWrappingInlineTextContent):

    Canonical link: https://commits.webkit.org/272448.28@safari-7618-branch

Canonical link: https://commits.webkit.org/274313.58@webkitglib/2.44

LayoutTests/fast/text/out-of-flow-line-break-crash-expected.txt

@@ -0,0 +1,4 @@
+PASS if no crash or assert.
+
+
+text

LayoutTests/fast/text/out-of-flow-line-break-crash.html

@@ -0,0 +1,24 @@
+<style>
+br, span, pre, a {
+  position: absolute;
+}
+</style>
+PASS if no crash or assert.
+<div id=container>
+  <meter id=meter>
+  <textarea id=textarea>foobar</textarea>
+</div>
+<meter id=mm></meter>
+<pre contenteditable="true">
+  <embed id=embed><span></span>
+</pre>
+<script>
+  if (window.testRunner)
+    testRunner.dumpAsText();
+  embed.appendChild(meter);
+  textarea.setSelectionRange(1,0,"text");
+  container.appendChild(meter);
+  document.execCommand("selectAll", false);
+  document.execCommand("createLink", false, "#link");
+  document.execCommand("insertText", false, "text");
+</script>

Source/WebCore/layout/formattingContexts/inline/InlineItemsBuilder.cpp

@@ -133,7 +133,7 @@ void InlineItemsBuilder::build(InlineItemPosition startPosition)
 
 static inline bool isTextOrLineBreak(const Box& layoutBox)
 {
-    return layoutBox.isInlineTextBox() || (layoutBox.isLineBreakBox() && !layoutBox.isWordBreakOpportunity());
+    return layoutBox.isInFlow() && (layoutBox.isInlineTextBox() || (layoutBox.isLineBreakBox() && !layoutBox.isWordBreakOpportunity()));
 }
 
 static bool requiresVisualReordering(const Box& layoutBox)

Source/WebCore/layout/formattingContexts/inline/TextOnlySimpleLineBuilder.cpp

@@ -231,7 +231,6 @@ InlineItemPosition TextOnlySimpleLineBuilder::placeNonWrappingInlineTextContent(
 
     while (!isEndOfLine) {
         auto& inlineItem = m_inlineItemList[nextItemIndex];
-        ASSERT(inlineItem.isText() || inlineItem.isLineBreak());
         if (inlineItem.isText()) {
             auto contentWidth = [&] {
                 if (auto logicalWidth = downcast<InlineTextItem>(inlineItem).width())
@@ -241,6 +240,10 @@ InlineItemPosition TextOnlySimpleLineBuilder::placeNonWrappingInlineTextContent(
             candidateContent.append(contentWidth());
         } else if (inlineItem.isLineBreak())
             trailingLineBreakIndex = nextItemIndex;
+        else {
+            ASSERT_NOT_REACHED();
+            return layoutRange.end;
+        }
         ++nextItemIndex;
         isEndOfLine = nextItemIndex >= layoutRange.endIndex() || trailingLineBreakIndex.has_value();
     }