Don't look for a sibling of a resumed node if we've seen all children.
NGBlockChildIterator would call NGBlockNode::NextSibling() in an inline
formatting context when we were at the last child break token for a
float. Floats become regular block children when resumed, so we cannot
really call NextSibling() on them at all. And we don't have to, since
there'll either be a break token to tell us where to resume in the
inline formatting context, if there is anything at all to resume.
Otherwise HasSeenAllChildren() will return true, and we can stop.
Fix and clean up NGBlockChildIterator, to hopefully make it easier to
follow.
Bug: 1249828
Change-Id: I91d03a2bfd0394a594d99ba512a992f29b4848ba
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3162059
Reviewed-by: Ian Kilpatrick <ikilpatrick@chromium.org>
Commit-Queue: Morten Stenshorne <mstensho@chromium.org>
Cr-Commit-Position: refs/heads/main@{#921777}
diff --git a/css/css-break/resumed-float-and-inline-block-crash.html b/css/css-break/resumed-float-and-inline-block-crash.html
new file mode 100644
index 0000000..c86034c
--- /dev/null
+++ b/css/css-break/resumed-float-and-inline-block-crash.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1249828">
+<div style="columns:3; column-fill:auto; height:100px;">
+ <div style="float:left; width:50px; height:150px;"></div>
+ <div style="display:inline-block; width:30px; height:10px;"></div>
+</div>
