Merge 104183 - Source/WebCore: Crash due to reparenting of relpositioned object under anonymous b...

Merge 104183 - Source/WebCore: Crash due to reparenting of relpositioned object under anonymous block
https://bugs.webkit.org/show_bug.cgi?id=70848

The associated test case creates a condition where a relative
positioned renderer is a descendant of an anonymous block for a
table column. The anonymous block is the containingBlock() for the
relpositioned renderer. Removal of a div causes the anonymous blocks to
be merged, and the renderer becomes a descendant of a different block.
Since the new containingBlock() has an empty positionedObject list,
the relpositioned renderer does not get layout after being dirtied.

This patch changes containingBlock() so that it returns the container
of an anonymous block for positioned objects, not the anonymous
block itself. It also adds an ASSERT to insertPositionedObject()
to flag any other cases where something is trying to create a
positioned object list on an anonymous block.

Patch by Ken Buchanan <kenrb@chromium.org>; on 2012-01-05
Reviewed by David Hyatt.

* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::insertPositionedObject):
* rendering/RenderObject.cpp:
(WebCore::RenderObject::containingBlock):

LayoutTests: Crash due to reparenting of relpositioned object in table
https://bugs.webkit.org/show_bug.cgi?id=70848

Adding test that exercises the crash condition in bug 70848.

Patch by Ken Buchanan <kenrb@chromium.org>; on 2012-01-05
Reviewed by David Hyatt.

* fast/css/relative-position-replaced-in-table-display-crash-expected.txt: Added
* fast/css/relative-position-replaced-in-table-display-crash.html: Added
Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=105337