Mark column sets as invalid and kill the interval tree when column sets are removed.

Source/core/layout/LayoutFlowThread.cpp

Index: Source/core/layout/LayoutFlowThread.cpp
diff --git a/Source/core/layout/LayoutFlowThread.cpp b/Source/core/layout/LayoutFlowThread.cpp
index c0ba41a2044929fe3402946925907d600cacd81d..90fba5ebcf78f417cddd967f1e0da87c0fbbafd3 100644
--- a/Source/core/layout/LayoutFlowThread.cpp
+++ b/Source/core/layout/LayoutFlowThread.cpp
@@ -48,6 +48,13 @@ void LayoutFlowThread::removeColumnSetFromThread(LayoutMultiColumnSet* columnSet
 {
     ASSERT(columnSet);
     m_multiColumnSetList.remove(columnSet);
+    invalidateColumnSets();
+    // Clear the interval tree right away, instead of leaving it around with dead objects. Not that
+    // anyone _should_ try to access the interval tree when the column sets are marked as invalid,
+    // but this is actually possible if other parts of the engine has bugs that cause us to not lay
+    // out everything that was marked for layout, so that LayoutObject::assertLaidOut() (and a LOT
+    // of other assertions) fails.
+    m_multiColumnSetIntervalTree.clear();
 }
 
 void LayoutFlowThread::invalidateColumnSets()