Merge 97786 - Crash in RenderDeprecatedFlexibleBox::layoutHorizontalBox

LayoutTests/fast/flexbox/layoutHorizontalBox-crash.html

 <style>
 .c6:first-letter { visibility: hidden; }
 .c6:nth-last-child(2n+10000000000000000) { text-align: -webkit-center; width: 10px; }
 .c26:first-letter { visibility: inherit; overflow: scroll; float: left;</style>
 <script>
 if (window.layoutTestController)
     layoutTestController.dumpAsText();
 
 function runTest() {
     var button = document.createElement('button');
     button.setAttribute('class', 'c6');
     document.documentElement.appendChild(button);
     document.documentElement.appendChild(document.createElement('dfn'));
     var figCaption = document.createElement('figcaption');
     figCaption.setAttribute('class', 'c26');
     document.documentElement.appendChild(document.createElement('var'));
     document.documentElement.appendChild(document.createElement('summary'));
     var text = document.createTextNode("bug 70183: Crash in RenderDeprecatedFlexibleBox::layoutHorizontalBox");
     figCaption.appendChild(text);
     button.appendChild(figCaption);
     document.body.offsetTop;
     document.documentElement.appendChild(document.createTextNode("If this test did not CRASH or show errors in valgrind, it has PASSED."));
 }
 window.onload = runTest;
 </script>