[FragmentItem] Clear inline fragment index for positioned objects

When once laid out floating object is changed to a positioned object, it may have |FirstInlineFragmentItemIndex| set, but positioned objects should not have the index because they do not produce |NGFragmentIem|. This patch makes sure the index is cleared for positioned objects. Also this patch turns DCHECK in |NGInlineCursor::MoveTo| to NOTREACHED + return to avoid such case could result in crash. This is a regression in r784297 <crrev.com/c/2275373>, which started to index floating objects. Bug: 1101277 Change-Id: I21a75440c3aa77a8d66b1e002d05ff2b252e6b94 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2275820 Reviewed-by: Kent Tamura <tkent@chromium.org> Reviewed-by: Yoshifumi Inoue <yosin@chromium.org> Commit-Queue: Koji Ishii <kojii@chromium.org> Cr-Commit-Position: refs/heads/master@{#784685}
web-platform-tests · Jul 2, 2020 · b512d34 · b512d34
1 parent dc9327c
commit b512d34
Showing 1 changed file with 31 additions and 0 deletions.
diff --git a/css/CSS2/floats/remove-float-then-abspos-in-inline.html b/css/CSS2/floats/remove-float-then-abspos-in-inline.html
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<title>Removing floats changed to positioned object should not crash</title>
+<link rel="author" href="kojii@chromium.org">
+<link rel="help" href="https://crbug.com/1101277">
+<meta name="assert" content="Removing floats changed to positioned object should not crash">
+<style>
+.float {
+  float: left;
+}
+.abs {
+  position: absolute;
+}
+</style>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<body>
+  <div id="container">text<span id="target" class="float"></span></div>
+</body>
+<script>
+test(() => {
+  document.body.offsetTop;
+  let target = document.getElementById('target');
+
+  // Change `#target` from floating object to positioned object.
+  target.className = 'abs';
+  document.body.offsetTop;
+
+  // and remove it.
+  target.remove();
+}, 'No crash or DCHECK failure');
+</script>