Harden column splitting code against bad casts. Make sure that |curr| is a descendant of |fromBlock…

Source/core/rendering/RenderBlock.cpp

Index: Source/core/rendering/RenderBlock.cpp
diff --git a/Source/core/rendering/RenderBlock.cpp b/Source/core/rendering/RenderBlock.cpp
index bb635eeac056714267fad06dfe35ffd829d735bc..30e43b01955960fd53297fd36b7a234989f4a0ea 100644
--- a/Source/core/rendering/RenderBlock.cpp
+++ b/Source/core/rendering/RenderBlock.cpp
@@ -625,7 +625,7 @@ void RenderBlock::splitBlocks(RenderBlock* fromBlock, RenderBlock* toBlock,
     RenderBoxModelObject* currChild = this;
     RenderObject* currChildNextSibling = currChild->nextSibling();
 
-    while (curr && curr != fromBlock) {
+    while (curr && curr->isDescendantOf(fromBlock) && curr != fromBlock) {

[esprehn, 2013/04/19 21:24:52]

This isn't right. The loop is going from curr through ->parent() so you only
need to check this once before the loop. Right now you're walking up through all
the levels of the tree repeatedly.

         ASSERT_WITH_SECURITY_IMPLICATION(curr->isRenderBlock());
         
         RenderBlock* blockCurr = toRenderBlock(curr);