Merge 115458 - NULL-deref in RenderBox::clippedOverflowRectForRepaint

Merge 115458 - NULL-deref in RenderBox::clippedOverflowRectForRepaint
https://bugs.webkit.org/show_bug.cgi?id=84774

Reviewed by Tony Chang.

Source/WebCore:

Test: fast/inline/crash-new-continuation-with-outline.html

The bug comes from trying to repaint the :after content as part of updateBeforeAfterContent.
The repainting logic would query the yet-to-be-inserted continuation(). Then we would crash in
RenderBox::clippedOverflowRectForRepaint as we didn't have an enclosingLayer() (which any
RenderObject in the tree will have).

The fix is to check in RenderInline::clippedOverflowRectForRepaint that our continuation()
is properly inserted in the tree. We could check that it isRooted() but it's an overkill here.

* rendering/RenderInline.cpp:
(WebCore::RenderInline::clippedOverflowRectForRepaint):

LayoutTests:

* fast/inline/crash-new-continuation-with-outline-expected.txt: Added.
* fast/inline/crash-new-continuation-with-outline.html: Added.


TBR=jchaffraix@webkit.org
Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=116441