https://bugs.webkit.org/show_bug.cgi?id=91138

Reviewed by Abhishek Arya.

Source/WebCore:

EllipsisBox would hold on to m_markupBox, which would then get destroyed during
the followup layoutIfNeeded in layoutVerticalBox. Instead, have EllipsisBox
dynamically grab to pointer to the markup box during paint since there's no
straightforward way to notify the EllipsisBox that the markupBox has been destroyed
and/or point it at the new markupBox.

Test: fast/overflow/line-clamp-and-columns.html

* rendering/EllipsisBox.cpp:
(WebCore::EllipsisBox::paint):
(WebCore):
(WebCore::EllipsisBox::paintMarkupBox):
* rendering/EllipsisBox.h:
(WebCore::EllipsisBox::EllipsisBox):
Just store a boolean that we have a markup box that needs painting.
* rendering/RenderDeprecatedFlexibleBox.cpp:
(WebCore::RenderDeprecatedFlexibleBox::applyLineClamp):
Clearing the override size right after setting it was incorrect because
there are cases where we'll do a followup layout in layoutVerticalBox, at which
point we'll still need the override size.
(WebCore::RenderDeprecatedFlexibleBox::clearLineClamp):
Clear the override size here to handle cases where line clamp is removed since
we don't call applyLineClamp in those cases.

LayoutTests:

* fast/overflow/line-clamp-and-columns-expected.html: Added.
* fast/overflow/line-clamp-and-columns.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@125635 268f45cc-cd09-0410-ab3c-d52691b4dbfc