Fix crash when removing layout managers.

sky/engine/core/dom/Element.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Peter Kelly (pmk@post.com)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  *           (C) 2007 David Smith (catfish.man@gmail.com)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2012, 2013 Apple Inc. All rights reserved.
  *           (C) 2007 Eric Seidel (eric@webkit.org)
  *
  * This library is free software; you can redistribute it and/or
@@ skipping 946 matching lines @@
         box->layoutIfNeeded();
 }
 
 LayoutCallback* Element::layoutManager() const
 {
     return m_layoutManager.get();
 }
 
 void Element::setLayoutManager(PassOwnPtr<LayoutCallback> callback)
 {
-    if (renderer() && !renderer()->isRenderCustomLayout()) {
+    bool isAlreadyCustomLayout = renderer() && renderer()->isRenderCustomLayout();

[Hixie, 2015/04/14 20:53:38]

Shouldn't this be checking callback != m_layoutManager? If the new layout
manager is the same as the old one, then presumably we don't need to be marked
dirty.

[ojan, 2015/04/14 20:55:05]

Hmmm...this points to a different bug. If the layout managers are different,
then we need to call setNeedsLayout here. Will fix in a followup patch.

+    bool requiresCustomLayout = callback;
+    if (requiresCustomLayout != isAlreadyCustomLayout) {
         // We don't go through the normal reattach codepaths because
         // those are all tied to changes to the RenderStyle.
         markAncestorsWithChildNeedsStyleRecalc();
         detach();
     }
     m_layoutManager = callback;
 }
 
 void Element::childrenChanged(const ChildrenChange& change)
 {
@@ skipping 664 matching lines @@
         return false;
     if (treeScope().scopedStyleResolver().hasSelectorForId(idValue))
         return true;
     // Host rules could also have effects.
     if (ShadowRoot* shadowRoot = this->shadowRoot())
         return shadowRoot->scopedStyleResolver().hasSelectorForId(idValue);
     return false;
 }
 
 } // namespace blink