commit d15ee17c738f71d4202354bb10f6c7bf1e627d1e
author Aleks Totic <atotic@chromium.org> Tue May 14 22:42:21 2019
committer Commit Bot <commit-bot@chromium.org> Tue May 14 22:42:21 2019
tree 33937d98733140f1103f893d31b0820a44fc9f4f
parent 8268630b965a2b6acc29e9ab1a93d94175a7a432

[LayoutNG] More limited inline split fix

This testcase hit a DCHECK while rebalancing split inlines

LayoutInline::SplitInlines
  LayoutBoxModelObject::MoveChildTo

Layout tree looks like it should work. I think that our previous
fix of not splitting any anonymous inlines was incorrect.
This reverts my older fix at
https://chromium-review.googlesource.com/c/chromium/src/+/1610522/1

to a more conservative skip:

if (o->IsLayoutNGInsideListMarker())

instead of

if (o->IsAnonymous())

clusterfuzz layout tree looks like this:

    LayoutNGBlockFlow 0x71c8ea202a0  	FORM id="el0"
        LayoutNGBlockFlow (anonymous) 0x71c8ea20530
          LayoutInline (anonymous) 0x71c8ea303d0
*           LayoutInline 0x71c8ea30250 continuation=0x71c8ea203e8	Q id="el2"
              LayoutInline 0x71c8ea30310	<pseudo:before>
                LayoutQuote (anonymous) 0x71c8ea3c2f8
                  LayoutTextFragment (anonymous) 0x71c8ea40370 """
            LayoutInline 0x71c8ea30190 	Q id="el5"
              LayoutInline 0x71c8ea300d0	<pseudo:before>
                LayoutQuote (anonymous) 0x71c8ea3c108
                  LayoutTextFragment (anonymous) 0x71c8ea40130 "'"
              LayoutInline 0x71c8ea30490	<pseudo:after>
                LayoutQuote (anonymous) 0x71c8ea3c010
                  LayoutTextFragment (anonymous) 0x71c8ea4001

Bug: 962841
Change-Id: I5165089499c2ff7856f999d2926e07d4a992960d
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1611866
Reviewed-by: Morten Stenshorne <mstensho@chromium.org>
Reviewed-by: Emil A Eklund <eae@chromium.org>
Commit-Queue: Aleks Totic <atotic@chromium.org>
Cr-Commit-Position: refs/heads/master@{#659700}