<rdar://problem/9190108> Crash when hiding a float

Reviewed by Simon Fraser.

Source/WebCore: 

Test: fast/block/float/overhanging-tall-block.html

* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::addOverhangingFloats): Moved the call to childLogicalTop() out of the loop.
Capped the logical bottom so that we get the correct maximum.
* rendering/RenderBlock.h: Decleared appendFloatingObjectToLastLine().
* rendering/RenderBlockLineLayout.cpp:
(WebCore::RenderBlock::appendFloatingObjectToLastLine): Added. Ensures correct bookkeeping by
extending the float if needed so that it touches the line.
(WebCore::RenderBlock::layoutInlineChildren): Changed to call appendFloatingObjectToLastLine().
(WebCore::RenderBlock::checkFloatsInCleanLine): Capped the float height so the we mark the right
range of lines as dirty.
* rendering/RootInlineBox.h:
(WebCore::RootInlineBox::appendFloat): Replaced the floats() accessor with this function, which
allows the creation of the vector to be combined with appending the first float.

LayoutTests: 

* fast/block/float/overhanging-tall-block.html: Added.
* platform/mac/fast/block/float/overhanging-tall-block-expected.checksum: Added.
* platform/mac/fast/block/float/overhanging-tall-block-expected.png: Added.
* platform/mac/fast/block/float/overhanging-tall-block-expected.txt: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@84096 268f45cc-cd09-0410-ab3c-d52691b4dbfc
10 files changed