Merge 125810

Source/WebCore/rendering/RenderBlockLineLayout.cpp

Index: Source/WebCore/rendering/RenderBlockLineLayout.cpp
===================================================================
--- Source/WebCore/rendering/RenderBlockLineLayout.cpp	(revision 126628)
+++ Source/WebCore/rendering/RenderBlockLineLayout.cpp	(working copy)
@@ -1476,8 +1476,13 @@
          deleteEllipsisLineBoxes();
 
     if (firstChild()) {
-        // layout replaced elements
+        // In full layout mode, clear the line boxes of children upfront. Otherwise,
+        // siblings can run into stale root lineboxes during layout. Then layout
+        // the replaced elements later. In partial layout mode, line boxes are not
+        // deleted and only dirtied. In that case, we can layout the replaced
+        // elements at the same time.
         bool hasInlineChild = false;
+        Vector<RenderBox*> replacedChildren;
         for (InlineWalker walker(this); !walker.atEnd(); walker.advance()) {
             RenderObject* o = walker.current();
             if (!hasInlineChild && o->isInline())
@@ -1497,9 +1502,13 @@
                     o->containingBlock()->insertPositionedObject(box);
                 else if (o->isFloating())
                     layoutState.floats().append(FloatWithRect(box));
-                else if (layoutState.isFullLayout() || o->needsLayout()) {
-                    // Replaced elements
-                    toRenderBox(o)->dirtyLineBoxes(layoutState.isFullLayout());
+                else if (isFullLayout || o->needsLayout()) {
+                    // Replaced element.
+                    box->dirtyLineBoxes(isFullLayout);
+                    if (isFullLayout)
+                        replacedChildren.append(box);
+                    else
+                        o->layoutIfNeeded();
                 }
             } else if (o->isText() || (o->isRenderInline() && !walker.atEndOfInline())) {
                 if (!o->isText())
@@ -1510,6 +1519,11 @@
             }
         }
 
+        if (replacedChildren.size()) {
+            for (size_t i = 0; i < replacedChildren.size(); i++)
+                 replacedChildren[i]->layoutIfNeeded();
+        }
+
         layoutRunsAndFloats(layoutState, hasInlineChild);
     }
 
@@ -2269,7 +2283,6 @@
             width.addUncommittedWidth(borderPaddingMarginStart(flowBox) + borderPaddingMarginEnd(flowBox));
         } else if (current.m_obj->isReplaced()) {
             RenderBox* replacedBox = toRenderBox(current.m_obj);
-            replacedBox->layoutIfNeeded();
 
             // Break on replaced elements if either has normal white-space.
             if ((autoWrap || RenderStyle::autoWrap(lastWS)) && (!current.m_obj->isImage() || allowImagesToBreak)) {