[FragmentItem] Clear inline fragment index for positioned objects
When once laid out floating object is changed to a positioned
object, it may have |FirstInlineFragmentItemIndex| set, but
positioned objects should not have the index because they do
not produce |NGFragmentIem|. This patch makes sure the index
is cleared for positioned objects.
Also this patch turns DCHECK in |NGInlineCursor::MoveTo| to
NOTREACHED + return to avoid such case could result in crash.
This is a regression in r784297 <crrev.com/c/2275373>, which
started to index floating objects.
Bug: 1101277
Change-Id: I21a75440c3aa77a8d66b1e002d05ff2b252e6b94
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2275820
Reviewed-by: Kent Tamura <tkent@chromium.org>
Reviewed-by: Yoshifumi Inoue <yosin@chromium.org>
Commit-Queue: Koji Ishii <kojii@chromium.org>
Cr-Commit-Position: refs/heads/master@{#784685}
diff --git a/css/CSS2/floats/remove-float-then-abspos-in-inline.html b/css/CSS2/floats/remove-float-then-abspos-in-inline.html
new file mode 100644
index 0000000..5cf8084
--- /dev/null
+++ b/css/CSS2/floats/remove-float-then-abspos-in-inline.html
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<title>Removing floats changed to positioned object should not crash</title>
+<link rel="author" href="kojii@chromium.org">
+<link rel="help" href="https://crbug.com/1101277">
+<meta name="assert" content="Removing floats changed to positioned object should not crash">
+<style>
+.float {
+ float: left;
+}
+.abs {
+ position: absolute;
+}
+</style>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<body>
+ <div id="container">text<span id="target" class="float"></span></div>
+</body>
+<script>
+test(() => {
+ document.body.offsetTop;
+ let target = document.getElementById('target');
+
+ // Change `#target` from floating object to positioned object.
+ target.className = 'abs';
+ document.body.offsetTop;
+
+ // and remove it.
+ target.remove();
+}, 'No crash or DCHECK failure');
+</script>
