Fix line cache for simplified layout
In normal layout, the layout algorithm computes the range safe
to copy from previous fragment items by calling
|EndOfReusableItems| and copy the safe range only.
The simplified layout computes its applicability first too,
but in a different way. In most cases, all fragment items are
reusable with this logic, but there are some edge cases where
it think it's applicable but some fragment items are not
reusable, such as when bidi segmentations change
<r816560 crrev.com/c/2467816>.
This patch detects such condition in |AddPreviousItems| to
abort copying previously laid out items, and let
|NGSimplifiedLayoutAlgorithm| report that the simplified
layout was not applicable. The |NGSimplifiedLayoutAlgorithm|
then falls back to the normal layout.
Bug: 1242194
Change-Id: I618edf18c0ce3dc356fa1a18f8901c9e60bf4f22
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3600090
Reviewed-by: Kent Tamura <tkent@chromium.org>
Auto-Submit: Koji Ishii <kojii@chromium.org>
Commit-Queue: Koji Ishii <kojii@chromium.org>
Cr-Commit-Position: refs/heads/main@{#995108}
diff --git a/css/CSS2/linebox/crashtests/dir-change-simplifed-crash.html b/css/CSS2/linebox/crashtests/dir-change-simplifed-crash.html
new file mode 100644
index 0000000..4e05bc8
--- /dev/null
+++ b/css/CSS2/linebox/crashtests/dir-change-simplifed-crash.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<link rel="help" href="https://drafts.csswg.org/css2/#direction">
+<link rel="author" title="Koji Ishii" href="mailto:kojii@chromium.org">
+<style>
+body, div { position: absolute; }
+body { direction: rtl; white-space: pre-line; }
+</style>
+<body>  
'123456789<div> </div>
+<script>
+ // Force layout and await paint
+ document.body.offsetLeft;
+ requestAnimationFrame(() => requestAnimationFrame(() => {
+ document.querySelector("div").dir = "ltr";
+ }));
+</script>
+</body>
