Fix assert failure in RenderObjectChildList::removeChildNode

Fix assert failure in RenderObjectChildList::removeChildNode

Inserting an element before the fullscreened element could crash if it
caused a containing inline to be split, since the splitting logic
doesn't expect the fullscreened element to be wrapped in a
RenderFullScreen. This commit changes inline splitting to be aware of
RenderFullScreen. 

BUG=177688
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=150447

[falken, 2013-05-14 13:48:37]

Hi all,

What do you think of this idea?

It's definitely not ready to commit yet. For some reason the test passes on ToT
although it clearly crashes when run in DRT.

[inferno, 2013-05-14 21:01:03]

On 2013/05/14 20:32:42, inferno wrote:

This code path should be very hot. cced Elliot, Hajime for any ideas/workarounds
for this full screen problem.

[esprehn, 2013-05-14 21:32:28]

https://codereview.chromium.org/15165002/diff/2001/Source/core/dom/NodeRender...
File Source/core/dom/NodeRenderingContext.cpp (right):

https://codereview.chromium.org/15165002/diff/2001/Source/core/dom/NodeRender...
Source/core/dom/NodeRenderingContext.cpp:128: renderer =
element->document()->fullScreenRenderer();
This doesn't seem like the right place to fix this, why doesn't the splitting
logic just walk up if the renderer is the full screen one?

[falken, 2013-05-15 01:46:36]

https://codereview.chromium.org/15165002/diff/2001/Source/core/dom/NodeRender...
File Source/core/dom/NodeRenderingContext.cpp (right):

https://codereview.chromium.org/15165002/diff/2001/Source/core/dom/NodeRender...
Source/core/dom/NodeRenderingContext.cpp:128: renderer =
element->document()->fullScreenRenderer();
On 2013/05/14 21:32:28, esprehn wrote:
> This doesn't seem like the right place to fix this, why doesn't the splitting
> logic just walk up if the renderer is the full screen one?

Yeah I thought optimistically that fixing it in NodeRenderingContext could fix
other errors of this class but it may be too invasive. I'll give a go at fixing
it in the splitting logic instead.

[falken, 2013-05-15 06:11:38]

I've uploaded a new patch that fixes the splitting code directly.

I verified it fixes both the original fuzzer testcase and Eric's reduction
(which I've used in the patch).

[esprehn, 2013-05-15 06:52:16]

LGTM. This looks much better. Eventually we'll move full screen into top layer
and this stuff should become less fragile.

[commit-bot: I haz the power, 2013-05-15 09:22:22]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/falken@chromium.org/15165002/12001

[commit-bot: I haz the power, 2013-05-15 11:32:34]

Retried try job too often on blink_bare_presubmit for step(s) presubmit
http://build.chromium.org/p/tryserver.chromium/buildstatus?builder=blink_bare...

[commit-bot: I haz the power, 2013-05-15 13:53:53]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/falken@chromium.org/15165002/12001

[commit-bot: I haz the power, 2013-05-15 14:59:00]

Retried try job too often on blink_bare_presubmit for step(s) presubmit
http://build.chromium.org/p/tryserver.chromium/buildstatus?builder=blink_bare...

[commit-bot: I haz the power, 2013-05-15 15:41:44]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/falken@chromium.org/15165002/12001

[commit-bot: I haz the power, 2013-05-15 17:42:52]

Change committed as 150447