Mark column sets as invalid and kill the interval tree when column sets are removed.

Source/core/layout/LayoutFlowThread.cpp

 /*
  * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1. Redistributions of source code must retain the above
  *    copyright notice, this list of conditions and the following
  *    disclaimer.
@@ skipping 30 matching lines @@
     , m_columnSetsInvalidated(false)
     , m_columnSetsHaveUniformLogicalHeight(true)
     , m_pageLogicalSizeChanged(false)
 {
 }
 
 void LayoutFlowThread::removeColumnSetFromThread(LayoutMultiColumnSet* columnSet)
 {
     ASSERT(columnSet);
     m_multiColumnSetList.remove(columnSet);
+    invalidateColumnSets();
+    // Clear the interval tree right away, instead of leaving it around with dead objects. Not that
+    // anyone _should_ try to access the interval tree when the column sets are marked as invalid,
+    // but this is actually possible if other parts of the engine has bugs that cause us to not lay
+    // out everything that was marked for layout, so that LayoutObject::assertLaidOut() (and a LOT
+    // of other assertions) fails.
+    m_multiColumnSetIntervalTree.clear();
 }
 
 void LayoutFlowThread::invalidateColumnSets()
 {
     if (m_columnSetsInvalidated) {
         ASSERT(selfNeedsLayout());
         return;
     }
 
     setNeedsLayoutAndFullPaintInvalidation(LayoutInvalidationReason::ColumnsChanged);
@@ skipping 134 matching lines @@
 
 void LayoutFlowThread::MultiColumnSetSearchAdapter::collectIfNeeded(const MultiColumnSetInterval& interval)
 {
     if (m_result)
         return;
     if (interval.low() <= m_offset && interval.high() > m_offset)
         m_result = interval.data();
 }
 
 } // namespace blink