[IFC][Partial layout] Re-parenting type of insertion is not supported…

… yet

https://bugs.webkit.org/show_bug.cgi?id=261510
<rdar://115419901>

Reviewed by Antti Koivisto.

When an inline box (e.g. <q>) with a subtree gets re-parented (remove and insert) due to render tree normalization we
get the insert call on the root renderer (<q>) only while missing the individual insert notifications on the subtree renderers.

* LayoutTests/fast/inline/inline-re-parenting-crash-on-partial-layout-expected.txt: Added.
* LayoutTests/fast/inline/inline-re-parenting-crash-on-partial-layout.html: Added.
* Source/WebCore/layout/integration/LayoutIntegrationCoverage.cpp:
(WebCore::LayoutIntegration::shouldInvalidateLineLayoutPathAfterChangeFor):

Canonical link: https://commits.webkit.org/267958@main

LayoutTests/fast/inline/inline-re-parenting-crash-on-partial-layout-expected.txt

@@ -0,0 +1 @@
+PASS if no crash or assert. PASS if no crash or assert.

LayoutTests/fast/inline/inline-re-parenting-crash-on-partial-layout.html

@@ -0,0 +1,15 @@
+PASS if no crash or assert.
+<script>
+if (window.testRunner)
+  testRunner.dumpAsText();
+
+document.body.offsetTop;
+
+let documentElement = document.documentElement;
+documentElement.append(document.createTextNode("PASS if no crash or assert."));
+let remove_this = document.createElement('div');
+documentElement.append(remove_this);
+documentElement.append(document.createElement('q'));
+document.body.offsetTop;
+remove_this.remove();
+</script>

Source/WebCore/layout/integration/LayoutIntegrationCoverage.cpp

@@ -398,8 +398,10 @@ bool shouldInvalidateLineLayoutPathAfterChangeFor(const RenderBlockFlow& rootBlo
             return false;
         if (is<RenderLineBreak>(renderer))
             return true;
-        if (is<RenderReplaced>(renderer) || is<RenderInline>(renderer))
+        if (is<RenderReplaced>(renderer))
             return typeOfChange == TypeOfChangeForInvalidation::NodeInsertion;
+        if (is<RenderInline>(renderer))
+            return typeOfChange == TypeOfChangeForInvalidation::NodeInsertion && !downcast<RenderInline>(renderer).firstChild();
         return false;
     };
     if (!isSupportedRendererWithChange(renderer))