<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[195015] releases/WebKitGTK/webkit-2.10</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/195015">195015</a></dd>
<dt>Author</dt> <dd>carlosgc@webkit.org</dd>
<dt>Date</dt> <dd>2016-01-14 01:49:38 -0800 (Thu, 14 Jan 2016)</dd>
</dl>

<h3>Log Message</h3>
<pre>Merge <a href="http://trac.webkit.org/projects/webkit/changeset/192275">r192275</a> - Continuations with anonymous wrappers inside misplaces child renderers.
https://bugs.webkit.org/show_bug.cgi?id=150908

When a child is appended to an inline container and the beforeChild is not a direct child, but
it is inside a generated subtree, we need to special case the inline split to form continuation.

RenderInline::splitInlines() assumes that beforeChild is always a direct child of the current
inline container. However when beforeChild type requires wrapper content (such as table cells), the DOM and the
render tree get out of sync. In such cases, we need to ensure that both the beforeChild and its siblings end up
in the correct generated block.

Reviewed by Darin Adler and David Hyatt.

Source/WebCore:

Test: fast/inline/continuation-with-anon-wrappers.html

* rendering/RenderInline.cpp:
(WebCore::RenderInline::splitInlines):
(WebCore::RenderInline::addChildToContinuation):

LayoutTests:

* fast/inline/continuation-with-anon-wrappers-expected.txt: Added.
* fast/inline/continuation-with-anon-wrappers.html: Added.</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#releasesWebKitGTKwebkit210LayoutTestsChangeLog">releases/WebKitGTK/webkit-2.10/LayoutTests/ChangeLog</a></li>
<li><a href="#releasesWebKitGTKwebkit210SourceWebCoreChangeLog">releases/WebKitGTK/webkit-2.10/Source/WebCore/ChangeLog</a></li>
<li><a href="#releasesWebKitGTKwebkit210SourceWebCorerenderingRenderInlinecpp">releases/WebKitGTK/webkit-2.10/Source/WebCore/rendering/RenderInline.cpp</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li><a href="#releasesWebKitGTKwebkit210LayoutTestsfastinlinecontinuationwithanonwrappersexpectedtxt">releases/WebKitGTK/webkit-2.10/LayoutTests/fast/inline/continuation-with-anon-wrappers-expected.txt</a></li>
<li><a href="#releasesWebKitGTKwebkit210LayoutTestsfastinlinecontinuationwithanonwrappershtml">releases/WebKitGTK/webkit-2.10/LayoutTests/fast/inline/continuation-with-anon-wrappers.html</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="releasesWebKitGTKwebkit210LayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.10/LayoutTests/ChangeLog (195014 => 195015)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.10/LayoutTests/ChangeLog        2016-01-14 09:45:59 UTC (rev 195014)
+++ releases/WebKitGTK/webkit-2.10/LayoutTests/ChangeLog        2016-01-14 09:49:38 UTC (rev 195015)
</span><span class="lines">@@ -1,3 +1,21 @@
</span><ins>+2015-11-10  Zalan Bujtas  &lt;zalan@apple.com&gt;
+
+        Continuations with anonymous wrappers inside misplaces child renderers.
+        https://bugs.webkit.org/show_bug.cgi?id=150908
+
+        When a child is appended to an inline container and the beforeChild is not a direct child, but 
+        it is inside a generated subtree, we need to special case the inline split to form continuation.
+
+        RenderInline::splitInlines() assumes that beforeChild is always a direct child of the current
+        inline container. However when beforeChild type requires wrapper content (such as table cells), the DOM and the
+        render tree get out of sync. In such cases, we need to ensure that both the beforeChild and its siblings end up
+        in the correct generated block.
+
+        Reviewed by Darin Adler and David Hyatt.
+
+        * fast/inline/continuation-with-anon-wrappers-expected.txt: Added.
+        * fast/inline/continuation-with-anon-wrappers.html: Added.
+
</ins><span class="cx"> 2015-10-13  Zalan Bujtas  &lt;zalan@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Anonymous table objects: inline parent box requires inline-table child.
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit210LayoutTestsfastinlinecontinuationwithanonwrappersexpectedtxt"></a>
<div class="addfile"><h4>Added: releases/WebKitGTK/webkit-2.10/LayoutTests/fast/inline/continuation-with-anon-wrappers-expected.txt (0 => 195015)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.10/LayoutTests/fast/inline/continuation-with-anon-wrappers-expected.txt                                (rev 0)
+++ releases/WebKitGTK/webkit-2.10/LayoutTests/fast/inline/continuation-with-anon-wrappers-expected.txt        2016-01-14 09:49:38 UTC (rev 195015)
</span><span class="lines">@@ -0,0 +1,2 @@
</span><ins>+Test run: 720
+All passed.
</ins></span></pre></div>
<a id="releasesWebKitGTKwebkit210LayoutTestsfastinlinecontinuationwithanonwrappershtml"></a>
<div class="addfile"><h4>Added: releases/WebKitGTK/webkit-2.10/LayoutTests/fast/inline/continuation-with-anon-wrappers.html (0 => 195015)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.10/LayoutTests/fast/inline/continuation-with-anon-wrappers.html                                (rev 0)
+++ releases/WebKitGTK/webkit-2.10/LayoutTests/fast/inline/continuation-with-anon-wrappers.html        2016-01-14 09:49:38 UTC (rev 195015)
</span><span class="lines">@@ -0,0 +1,83 @@
</span><ins>+&lt;!DOCTYPE HTML&gt;
+&lt;html&gt;
+&lt;head&gt;
+&lt;title&gt;This tests that anon table content works well with continuation. It generates divs with display: table-cell inside a span and moves those cells out of the generated tables by setting display:block on them. This test checks that no matter how they form the continuation their order should always be 1 2 3 4 etc.&lt;/title&gt;
+&lt;style&gt;
+    .cell {
+        display: table-cell;
+    }
+&lt;/style&gt;
+&lt;/head&gt;
+&lt;body&gt;
+&lt;/body&gt;
+&lt;script&gt;
+if (window.testRunner)
+    testRunner.dumpAsText();
+
+var permArr = [];
+var usedChars = [];
+
+function permutateDivMoveOrder(input) {
+    var ch;
+    for (var i = 0; i &lt; input.length; i++) {
+        ch = input.splice(i, 1)[0];
+        usedChars.push(ch);
+        if (input.length == 0)
+            permArr.push(usedChars.slice());
+        permutateDivMoveOrder(input);
+        input.splice(i, 0, ch);
+        usedChars.pop();
+    }
+    return permArr;
+}
+
+function generateContent() {
+    var content = &quot;&lt;span&gt;[&quot;;
+    for (var i = 0; i &lt; numberOfDivs; ++i)
+        content += &quot;&lt;div id=&quot; + i + &quot; class='cell'&gt;&quot; + i + &quot;&lt;/div&gt;&quot;;
+    content += &quot;]&lt;/span&gt;&quot;;
+    return content;
+}
+
+function validateDivsPosition()
+{
+    var firstDiv = document.getElementById(&quot;0&quot;);
+    var prevOffsetLeft = firstDiv.offsetLeft;
+    var prevOffsetTop = firstDiv.offsetTop;
+    for (var i = 1; i &lt; numberOfDivs; ++i) {
+        var currentDiv = document.getElementById(i);
+        var pass = (prevOffsetLeft &lt; currentDiv.offsetLeft &amp;&amp; prevOffsetTop == currentDiv.offsetTop) 
+            || (prevOffsetLeft == currentDiv.offsetLeft &amp;&amp; prevOffsetTop &lt; currentDiv.offsetTop)
+            || (prevOffsetLeft &gt; currentDiv.offsetLeft &amp;&amp; prevOffsetTop &lt; currentDiv.offsetTop);
+        if (!pass)
+            return false;
+        prevOffsetLeft = currentDiv.offsetLeft;
+        prevOffsetTop = currentDiv.offsetTop;
+    }
+    return true;
+}
+
+function runTest(tests) {
+    var failed = &quot;&quot;;
+    for (var i = 0; i &lt; tests.length; ++i) {
+        document.body.innerHTML = generateContent();
+        for (var j = 0; j &lt; numberOfDivs; ++j) {
+            document.getElementById(tests[i][j]).classList.toggle(&quot;cell&quot;);
+            if (!validateDivsPosition()) {
+                failed += &quot; &quot; + i;
+                break;
+            }
+        }
+    }
+    var result = &quot;Test run: &quot; + tests.length;
+    if (failed.length)
+        result +=  &quot;&lt;br&gt;Failed cases: &quot; + failed;
+    else
+        result += &quot;&lt;br&gt;All passed.&quot;;
+    document.body.innerHTML = result;
+}
+
+var numberOfDivs = 6; // 6! = 720 tests.
+runTest(permutateDivMoveOrder([0, 1, 2, 3, 4, 5]));
+&lt;/script&gt;
+&lt;/html&gt;
</ins><span class="cx">\ No newline at end of file
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit210SourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.10/Source/WebCore/ChangeLog (195014 => 195015)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.10/Source/WebCore/ChangeLog        2016-01-14 09:45:59 UTC (rev 195014)
+++ releases/WebKitGTK/webkit-2.10/Source/WebCore/ChangeLog        2016-01-14 09:49:38 UTC (rev 195015)
</span><span class="lines">@@ -1,3 +1,24 @@
</span><ins>+2015-11-10  Zalan Bujtas  &lt;zalan@apple.com&gt;
+
+        Continuations with anonymous wrappers inside misplaces child renderers.
+        https://bugs.webkit.org/show_bug.cgi?id=150908
+
+        When a child is appended to an inline container and the beforeChild is not a direct child, but 
+        it is inside a generated subtree, we need to special case the inline split to form continuation.
+
+        RenderInline::splitInlines() assumes that beforeChild is always a direct child of the current
+        inline container. However when beforeChild type requires wrapper content (such as table cells), the DOM and the
+        render tree get out of sync. In such cases, we need to ensure that both the beforeChild and its siblings end up
+        in the correct generated block.
+
+        Reviewed by Darin Adler and David Hyatt.
+
+        Test: fast/inline/continuation-with-anon-wrappers.html
+
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::splitInlines):
+        (WebCore::RenderInline::addChildToContinuation):
+
</ins><span class="cx"> 2015-10-13  Zalan Bujtas  &lt;zalan@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Anonymous table objects: inline parent box requires inline-table child.
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit210SourceWebCorerenderingRenderInlinecpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.10/Source/WebCore/rendering/RenderInline.cpp (195014 => 195015)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.10/Source/WebCore/rendering/RenderInline.cpp        2016-01-14 09:45:59 UTC (rev 195014)
+++ releases/WebKitGTK/webkit-2.10/Source/WebCore/rendering/RenderInline.cpp        2016-01-14 09:49:38 UTC (rev 195015)
</span><span class="lines">@@ -412,8 +412,6 @@
</span><span class="cx"> {
</span><span class="cx">     // Create a clone of this inline.
</span><span class="cx">     RenderPtr&lt;RenderInline&gt; cloneInline = clone();
</span><del>-    cloneInline-&gt;setContinuation(oldCont);
-
</del><span class="cx"> #if ENABLE(FULLSCREEN_API)
</span><span class="cx">     // If we're splitting the inline containing the fullscreened element,
</span><span class="cx">     // |beforeChild| may be the renderer for the fullscreened element. However,
</span><span class="lines">@@ -424,18 +422,43 @@
</span><span class="cx">     if (fullScreenElement &amp;&amp; beforeChild &amp;&amp; beforeChild-&gt;node() == fullScreenElement)
</span><span class="cx">         beforeChild = document().fullScreenRenderer();
</span><span class="cx"> #endif
</span><del>-
</del><span class="cx">     // Now take all of the children from beforeChild to the end and remove
</span><span class="cx">     // them from |this| and place them in the clone.
</span><del>-    RenderObject* renderer = beforeChild;
-    while (renderer) {
-        RenderObject* tmp = renderer;
-        renderer = tmp-&gt;nextSibling();
-        removeChildInternal(*tmp, NotifyChildren);
-        cloneInline-&gt;addChildIgnoringContinuation(tmp);
-        tmp-&gt;setNeedsLayoutAndPrefWidthsRecalc();
</del><ins>+    for (RenderObject* rendererToMove = beforeChild; rendererToMove;) {
+        RenderObject* nextSibling = rendererToMove-&gt;nextSibling();
+        // When anonymous wrapper is present, we might need to move the whole subtree instead.
+        if (rendererToMove-&gt;parent() != this) {
+            auto* anonymousParent = rendererToMove-&gt;parent();
+            while (anonymousParent &amp;&amp; anonymousParent-&gt;parent() != this) {
+                ASSERT(anonymousParent-&gt;isAnonymous());
+                anonymousParent = anonymousParent-&gt;parent();
+            }
+            if (!anonymousParent) {
+                ASSERT_NOT_REACHED();
+                break;
+            }
+            // If beforeChild is the first child in the subtree, we could just move the whole subtree.
+            if (!rendererToMove-&gt;previousSibling()) {
+                // Reparent the whole anonymous wrapper tree.
+                rendererToMove = anonymousParent;
+                // Skip to the next sibling that is not in this subtree.
+                nextSibling = anonymousParent-&gt;nextSibling();
+            } else if (!rendererToMove-&gt;nextSibling()) {
+                // This is the last renderer in the subtree. We need to jump out of the wrapper subtree, so that
+                // the siblings are getting reparented too.
+                nextSibling = anonymousParent-&gt;nextSibling();
+            }
+            // Otherwise just move the renderer to the inline clone. Should the renderer need an anon
+            // wrapper, the addChild() will generate one for it.
+            // FIXME: When the anonymous wrapper has multiple children, we end up traversing up to the topmost wrapper
+            // every time, which is a bit wasteful.
+        }
+        rendererToMove-&gt;parent()-&gt;removeChildInternal(*rendererToMove, NotifyChildren);
+        cloneInline-&gt;addChildIgnoringContinuation(rendererToMove);
+        rendererToMove-&gt;setNeedsLayoutAndPrefWidthsRecalc();
+        rendererToMove = nextSibling;
</ins><span class="cx">     }
</span><del>-
</del><ins>+    cloneInline-&gt;setContinuation(oldCont);
</ins><span class="cx">     // Hook |clone| up as the continuation of the middle block.
</span><span class="cx">     middleBlock-&gt;setContinuation(cloneInline.get());
</span><span class="cx"> 
</span><span class="lines">@@ -468,13 +491,12 @@
</span><span class="cx"> 
</span><span class="cx">             // Now we need to take all of the children starting from the first child
</span><span class="cx">             // *after* currentChild and append them all to the clone.
</span><del>-            renderer = currentChild-&gt;nextSibling();
-            while (renderer) {
-                RenderObject* tmp = renderer;
-                renderer = tmp-&gt;nextSibling();
-                currentInline.removeChildInternal(*tmp, NotifyChildren);
-                cloneInline-&gt;addChildIgnoringContinuation(tmp);
-                tmp-&gt;setNeedsLayoutAndPrefWidthsRecalc();
</del><ins>+            for (auto* current = currentChild-&gt;nextSibling(); current;) {
+                auto* next = current-&gt;nextSibling();
+                currentInline.removeChildInternal(*current, NotifyChildren);
+                cloneInline-&gt;addChildIgnoringContinuation(current);
+                current-&gt;setNeedsLayoutAndPrefWidthsRecalc();
+                current = next;
</ins><span class="cx">             }
</span><span class="cx">         }
</span><span class="cx">         
</span><span class="lines">@@ -492,12 +514,11 @@
</span><span class="cx"> 
</span><span class="cx">     // Now take all the children after currentChild and remove them from the fromBlock
</span><span class="cx">     // and put them in the toBlock.
</span><del>-    renderer = currentChild-&gt;nextSibling();
-    while (renderer) {
-        RenderObject* tmp = renderer;
-        renderer = tmp-&gt;nextSibling();
-        fromBlock-&gt;removeChildInternal(*tmp, NotifyChildren);
-        toBlock-&gt;insertChildInternal(tmp, nullptr, NotifyChildren);
</del><ins>+    for (auto* current = currentChild-&gt;nextSibling(); current;) {
+        auto* next = current-&gt;nextSibling();
+        fromBlock-&gt;removeChildInternal(*current, NotifyChildren);
+        toBlock-&gt;insertChildInternal(current, nullptr, NotifyChildren);
+        current = next;
</ins><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -569,38 +590,43 @@
</span><span class="cx"> void RenderInline::addChildToContinuation(RenderObject* newChild, RenderObject* beforeChild)
</span><span class="cx"> {
</span><span class="cx">     RenderBoxModelObject* flow = continuationBefore(beforeChild);
</span><del>-    ASSERT(!beforeChild || is&lt;RenderBlock&gt;(*beforeChild-&gt;parent()) || is&lt;RenderInline&gt;(*beforeChild-&gt;parent()));
-    RenderBoxModelObject* beforeChildParent = nullptr;
-    if (beforeChild)
-        beforeChildParent = downcast&lt;RenderBoxModelObject&gt;(beforeChild-&gt;parent());
-    else {
-        if (RenderBoxModelObject* continuation = nextContinuation(flow))
-            beforeChildParent = continuation;
-        else
-            beforeChildParent = flow;
</del><ins>+    // It may or may not be the direct parent of the beforeChild.
+    RenderBoxModelObject* beforeChildAncestor = nullptr;
+    // In case of anonymous wrappers, the parent of the beforeChild is mostly irrelevant. What we need is
+    // the topmost wrapper.
+    if (beforeChild &amp;&amp; !is&lt;RenderBlock&gt;(beforeChild-&gt;parent()) &amp;&amp; beforeChild-&gt;parent()-&gt;isAnonymous()) {
+        RenderElement* anonymousParent = beforeChild-&gt;parent();
+        while (anonymousParent &amp;&amp; anonymousParent-&gt;parent() &amp;&amp; anonymousParent-&gt;parent()-&gt;isAnonymous())
+            anonymousParent = anonymousParent-&gt;parent();
+        ASSERT(anonymousParent &amp;&amp; anonymousParent-&gt;parent());
+        beforeChildAncestor = downcast&lt;RenderBoxModelObject&gt;(anonymousParent-&gt;parent());
+    } else {
+        ASSERT(!beforeChild || is&lt;RenderBlock&gt;(*beforeChild-&gt;parent()) || is&lt;RenderInline&gt;(*beforeChild-&gt;parent()));
+        if (beforeChild)
+            beforeChildAncestor = downcast&lt;RenderBoxModelObject&gt;(beforeChild-&gt;parent());
+        else {
+            if (RenderBoxModelObject* continuation = nextContinuation(flow))
+                beforeChildAncestor = continuation;
+            else
+                beforeChildAncestor = flow;
+        }
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     if (newChild-&gt;isFloatingOrOutOfFlowPositioned())
</span><del>-        return beforeChildParent-&gt;addChildIgnoringContinuation(newChild, beforeChild);
</del><ins>+        return beforeChildAncestor-&gt;addChildIgnoringContinuation(newChild, beforeChild);
</ins><span class="cx"> 
</span><ins>+    if (flow == beforeChildAncestor)
+        return flow-&gt;addChildIgnoringContinuation(newChild, beforeChild);
</ins><span class="cx">     // A continuation always consists of two potential candidates: an inline or an anonymous
</span><span class="cx">     // block box holding block children.
</span><span class="cx">     bool childInline = newChildIsInline(*newChild, *this);
</span><del>-    bool bcpInline = beforeChildParent-&gt;isInline();
-    bool flowInline = flow-&gt;isInline();
-
-    if (flow == beforeChildParent)
-        return flow-&gt;addChildIgnoringContinuation(newChild, beforeChild);
-    else {
-        // The goal here is to match up if we can, so that we can coalesce and create the
-        // minimal # of continuations needed for the inline.
-        if (childInline == bcpInline)
-            return beforeChildParent-&gt;addChildIgnoringContinuation(newChild, beforeChild);
-        else if (flowInline == childInline)
-            return flow-&gt;addChildIgnoringContinuation(newChild); // Just treat like an append.
-        else
-            return beforeChildParent-&gt;addChildIgnoringContinuation(newChild, beforeChild);
-    }
</del><ins>+    // The goal here is to match up if we can, so that we can coalesce and create the
+    // minimal # of continuations needed for the inline.
+    if (childInline == beforeChildAncestor-&gt;isInline())
+        return beforeChildAncestor-&gt;addChildIgnoringContinuation(newChild, beforeChild);
+    if (flow-&gt;isInline() == childInline)
+        return flow-&gt;addChildIgnoringContinuation(newChild); // Just treat like an append.
+    return beforeChildAncestor-&gt;addChildIgnoringContinuation(newChild, beforeChild);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void RenderInline::paint(PaintInfo&amp; paintInfo, const LayoutPoint&amp; paintOffset)
</span></span></pre>
</div>
</div>

</body>
</html>