Created attachment 223123 [details] Test case. When a float with an image valued shape-outside property is added dynamically, the layout it impacts isn't always updated automatically, after the image has loaded. Manually refreshing the page does fix up the layout. This bug was also reported here: https://code.google.com/p/chromium/issues/detail?id=339136
Created attachment 223141 [details] Patch Corrected the way shape-outside handles the completion of an image load. Move the shape-outside imageChanged() logic from RenderBlock to RenderBox and call markShapeOutsideDependentsForLayout() instead of parent()->setNeedsLayoutAndPrefWidthsRecalc(). The latter did not deal with descendants of the shape element's siblings correctly and it failed when the shape element was inserted dynamically. The markShapeOutsideDependentsForLayout() method can't be called during layout, so the imageChanged() code checks for that. The only scenario where imageChanged() can be called during layout (that I've discovered so far anyway) is when an SVG Image is renderered with drawImage(). The Shape::createRasterShape() does, and the corresponding imageChanged() notification can be safely ignored.
Moving this up to RenderBox seems okay to me. Could someone with better layout-fu have a look? (CC'd)
Comment on attachment 223141 [details] Patch Clearing flags on attachment: 223141 Committed r163458: <http://trac.webkit.org/changeset/163458>
All reviewed patches have been landed. Closing bug.