[balance-text] Fix break token propagation
When crrev.com/c/4369820 tried to move `PropagatedBreakTokens`
out of `NGLineBreaker`, it did:
1. Move propagated break tokens while line breaking to
`NGLineInfo`.
2. Move propagated break tokens while `CreateLine` to
`NGInlineChildLayoutContext`.
2 was not correct, because the algorithm may retry not only
line breaking but also `CreateLine` in certain cases, and
propagated break tokens from non-final `CreateLine` should not
be added to `NGInlineChildLayoutContext`.
This patch fixes this by changing `CreateLine` to add
propagated break tokens to `NGLineInfo`, and move them to
`NGInlineChildLayoutContext` only if the line layout is final.
Bug: 1429797
Change-Id: I7bd9d63ed1d25d28d5c265132daae9c66e741ec7
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4451970
Code-Coverage: Findit <findit-for-me@appspot.gserviceaccount.com>
Reviewed-by: Morten Stenshorne <mstensho@chromium.org>
Commit-Queue: Koji Ishii <kojii@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1133054}
diff --git a/css/css-multicol/crashtests/float-multicol-crash.html b/css/css-multicol/crashtests/float-multicol-crash.html
new file mode 100644
index 0000000..a8f01db
--- /dev/null
+++ b/css/css-multicol/crashtests/float-multicol-crash.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<style>
+#htmlvar00001 {
+ shape-outside: inset(-1px 8px 1px 1px);
+}
+
+* {
+ font-size: 1px;
+ float: right;
+ column-width: 7px;
+}
+</style>
+<select id="htmlvar00001" size="1"></select>
+<wbr>
+<span contenteditable="true"></span>
