[RenderTreeBuilder] Cleanup the inline box wrappers when moving subtrees

https://bugs.webkit.org/show_bug.cgi?id=224342
<rdar://76349279>

Reviewed by Antti Koivisto.

When an inline box is moved over to a different BFC (<span>), any inline level descendant (<span><img></span>) should release its inline box wrapper. This inline box wrapper (e.g. InlineFlowBox)
will eventually be destroy during the subsequent line layout of the original BFC.

* rendering/updating/RenderTreeBuilder.cpp:
(WebCore::RenderTreeBuilder::move):


Canonical link: https://commits.webkit.org/236339@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@275761 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/WebCore/ChangeLog

@@ -1,3 +1,17 @@
+2021-04-09  Zalan Bujtas  <zalan@apple.com>
+
+        [RenderTreeBuilder] Cleanup the inline box wrappers when moving subtrees
+        https://bugs.webkit.org/show_bug.cgi?id=224342
+        <rdar://76349279>
+
+        Reviewed by Antti Koivisto.
+
+        When an inline box is moved over to a different BFC (<span>), any inline level descendant (<span><img></span>) should release its inline box wrapper. This inline box wrapper (e.g. InlineFlowBox)
+        will eventually be destroy during the subsequent line layout of the original BFC.
+
+        * rendering/updating/RenderTreeBuilder.cpp:
+        (WebCore::RenderTreeBuilder::move):
+
 2021-04-09  Carlos Garcia Campos  <cgarcia@igalia.com>
 
         [GTK][WPE] Bump libsoup3 version to 2.99.3

Source/WebCore/rendering/updating/RenderTreeBuilder.cpp

@@ -486,6 +486,12 @@ void RenderTreeBuilder::move(RenderBoxModelObject& from, RenderBoxModelObject& t
         auto childToMove = detachFromRenderElement(from, child, WillBeDestroyed::No, RenderObject::IsInternalMove::Yes);
         attachToRenderElementInternal(to, WTFMove(childToMove), beforeChild, RenderObject::IsInternalMove::Yes);
     }
+    if (is<RenderInline>(child)) {
+        // When moving a subtree out of a BFC we need to make sure that the line boxes generated for the inline tree are not accessible anymore from the renderers.
+        // They eventually get destroyed during the inline layout of the original BFC.
+        for (auto& descendant : descendantsOfType<RenderBox>(downcast<RenderInline>(child)))
+            descendant.setInlineBoxWrapper(nullptr);
+    }
 }
 
 void RenderTreeBuilder::move(RenderBoxModelObject& from, RenderBoxModelObject& to, RenderObject& child, NormalizeAfterInsertion normalizeAfterInsertion)