Merge "DeferredShaping: Unlock when shaping-deferred IFC is switched …

…to BFC" to M103 branch

This is similar to crrev.com/986380, but for |position| property changes.

This CL moves the unlocking code into MakeChildrenNonInline() to support
a code path via HandleDynamicFloatPositionChange().

(cherry picked from commit e45a9fd)

Bug: 1259085, 1324458
Change-Id: I12d898393792cf28be75c0f0f1eb59e8912e6803
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3649905
Auto-Submit: Kent Tamura <tkent@chromium.org>
Reviewed-by: Koji Ishii <kojii@chromium.org>
Commit-Queue: Koji Ishii <kojii@chromium.org>
Commit-Queue: Kent Tamura <tkent@chromium.org>
Cr-Original-Commit-Position: refs/heads/main@{#1003688}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3651957
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/5060@{#47}
Cr-Branched-From: b83393d-refs/heads/main@{#1002911}

third_party/blink/renderer/core/layout/deferred_shaping_test.cc

@@ -350,6 +350,20 @@ TEST_F(DeferredShapingTest, UnlockOnSwithcingToBfc) {
   EXPECT_FALSE(IsLocked("target"));
 }
 
+// crbug.com/1324458
+TEST_F(DeferredShapingTest, UnlockOnSwithcingToBfcByChildPositionChange) {
+  SetBodyInnerHTML(R"HTML(<div style="height:1800px"></div>
+<li id="target">\n<div id="abs" style="position:absolute"></div></li>)HTML");
+  UpdateAllLifecyclePhasesForTest();
+  EXPECT_TRUE(IsDefer("target"));
+  EXPECT_TRUE(IsLocked("target"));
+
+  GetElementById("abs")->setAttribute("style", "position:static");
+  UpdateAllLifecyclePhasesForTest();
+  EXPECT_FALSE(IsDefer("target"));
+  EXPECT_FALSE(IsLocked("target"));
+}
+
 TEST_F(DeferredShapingTest, ScrollIntoView) {
   SetBodyInnerHTML(R"HTML(<div style="height:1800px"></div>
 <div><p id="prior">IFC</p></div>

third_party/blink/renderer/core/layout/layout_block_flow.cc

@@ -2858,10 +2858,6 @@ void LayoutBlockFlow::AddChild(LayoutObject* new_child,
 
   if (ChildrenInline()) {
     if (child_is_block_level) {
-      if (GetDisplayLockContext() && IsShapingDeferred()) {
-        GetDisplayLockContext()->SetRequestedState(
-            EContentVisibility::kVisible);
-      }
       // Wrap the inline content in anonymous blocks, to allow for the new block
       // child to be inserted.
       MakeChildrenNonInline(before_child);
@@ -3319,6 +3315,10 @@ static void GetInlineRun(LayoutObject* start,
 
 void LayoutBlockFlow::MakeChildrenNonInline(LayoutObject* insertion_point) {
   NOT_DESTROYED();
+
+  if (GetDisplayLockContext() && IsShapingDeferred())
+    GetDisplayLockContext()->SetRequestedState(EContentVisibility::kVisible);
+
   // makeChildrenNonInline takes a block whose children are *all* inline and it
   // makes sure that inline children are coalesced under anonymous blocks.
   // If |insertionPoint| is defined, then it represents the insertion point for