Properly handle floats leaving an inline formatting context.
Revert all code changes from CL:3613771 and replace with this. The bad
CL just did SetIsInLayoutNGInlineFormattingContext(false), which would
leave fragment items behind pointing to layout objects. When such a
layout object would later on be deleted, the fragment items wouldn't be
notified, since IsInLayoutNGInlineFormattingContext was false.
Notify the fragment items that layout object becoming in-flow
non-floated will be "moved", to properly clear the association. There
was already code for this when going out-of-flow, but we also need this
when becoming in-flow non-floated.
Bug: 1331189
Change-Id: I888d81495627952b75ec33a83edce165f6a3ad01
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3714111
Commit-Queue: Koji Ishii <kojii@chromium.org>
Reviewed-by: Koji Ishii <kojii@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1016000}
diff --git a/css/css-inline/float-becomes-inflow-crash.html b/css/css-inline/float-becomes-inflow-crash.html
new file mode 100644
index 0000000..c820b09
--- /dev/null
+++ b/css/css-inline/float-becomes-inflow-crash.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1331189">
+<div id="elm" style="float:left;"></div>
+x
+<script>
+ document.body.offsetTop;
+ elm.style.cssFloat = "none";
+ getComputedStyle(elm).cssFloat;
+ elm.style.display = "none";
+</script>
