Merge 94541 - Crash in RenderObjectChildList::destroyLeftOverChildren()

Source/WebCore/rendering/RenderBlock.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2007 David Smith (catfish.man@gmail.com)
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) Research In Motion Limited 2010. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 638 matching lines @@
     // (1) Immediate children of a multi-column block can span.
     // (2) Nested block-level children with only block-level ancestors between them and the multi-column block can span.
     // (3) Nested children with block or inline ancestors between them and the multi-column block can span (this is when we
     // cross the streams and have to cope with both types of continuations mixed together).
     // This function currently supports (1) and (2).
     RenderBlock* columnsBlockAncestor = 0;
     if (!newChild->isText() && newChild->style()->columnSpan() && !newChild->isFloatingOrPositioned()
         && !newChild->isInline() && !isAnonymousColumnSpanBlock()) {
         if (style()->specifiesColumns())
             columnsBlockAncestor = this;
-        else if (!isInline() && parent() && parent()->isRenderBlock())
+        else if (!isInline() && parent() && parent()->isRenderBlock()) {
             columnsBlockAncestor = toRenderBlock(parent())->containingColumnsBlock(false);
+            
+            if (columnsBlockAncestor) {
+                // Make sure that none of the parent ancestors have a continuation.
+                // If yes, we do not want split the block into continuations.
+                RenderObject* curr = this;
+                while (curr && curr != columnsBlockAncestor) {
+                    if (curr->isRenderBlock() && toRenderBlock(curr)->continuation()) {
+                        columnsBlockAncestor = 0;
+                        break;
+                    }
+                    curr = curr->parent();
+                }
+            }
+        }
     }
     return columnsBlockAncestor;
 }
 
 void RenderBlock::addChildIgnoringAnonymousColumnBlocks(RenderObject* newChild, RenderObject* beforeChild)
 {
     // Make sure we don't append things after :after-generated content if we have it.
     if (!beforeChild) {
         RenderObject* lastRenderer = lastChild();
         while (lastRenderer && lastRenderer->isAnonymous() && !isAfterContent(lastRenderer))
@@ skipping 5731 matching lines @@
 void RenderBlock::showLineTreeAndMark(const InlineBox* markedBox1, const char* markedLabel1, const InlineBox* markedBox2, const char* markedLabel2, const RenderObject* obj) const
 {
     showRenderObject();
     for (const RootInlineBox* root = firstRootBox(); root; root = root->nextRootBox())
         root->showLineTreeAndMark(markedBox1, markedLabel1, markedBox2, markedLabel2, obj, 1);
 }
 
 #endif
 
 } // namespace WebCore