Invalidate existing inline layout content when simplified out-of-flow…

… is sufficient

https://bugs.webkit.org/show_bug.cgi?id=267487
rdar://120496542

Reviewed by Antti Koivisto.

Do not leave stale inline content around.

* LayoutTests/fast/inline/dynamic-inline-content-with-out-of-flow-child-expected.txt: Added.
* LayoutTests/fast/inline/dynamic-inline-content-with-out-of-flow-child.html: Added.
* Source/WebCore/rendering/RenderBlockFlow.cpp:
(WebCore::RenderBlockFlow::layoutModernLines):

Originally-landed-as: 272448.102@safari-7618-branch (6d2f579). rdar://124556312
Canonical link: https://commits.webkit.org/276105@main

LayoutTests/fast/inline/dynamic-inline-content-with-out-of-flow-child-expected.txt

@@ -0,0 +1,2 @@
+
+PASS if no crash or assert

LayoutTests/fast/inline/dynamic-inline-content-with-out-of-flow-child.html

@@ -0,0 +1,19 @@
+<style>
+img {
+  position: absolute;
+}
+</style>
+<div><img id=img></div>
+<div id=move_here>remove</div>
+<div id=result></div>
+<script>
+if (window.testRunner)
+  testRunner.dumpAsText();
+document.execCommand("selectAll", false);
+let selection = document.getSelection();
+move_here.appendChild(img);
+document.body.offsetHeight;
+selection.deleteFromDocument();
+document.body.offsetHeight;
+result.innerText = "PASS if no crash or assert";
+</script>

Source/WebCore/rendering/RenderBlockFlow.cpp

@@ -4042,6 +4042,8 @@ void RenderBlockFlow::layoutModernLines(bool relayoutChildren, LayoutUnit& repai
 
     if (hasSimpleOutOfFlowContentOnly) {
         // Shortcut the layout.
+        m_lineLayout = std::monostate();
+
         setStaticPositionsForSimpleOutOfFlowContent();
         setLogicalHeight(borderAndPaddingBefore() + borderAndPaddingAfter() + scrollbarLogicalHeight());
         return;