[CSS Regions] Elements in a region should be assignable to a named flow

Source/core/rendering/RenderNamedFlowThread.cpp

 /*
  * Copyright (C) 2012 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 395 matching lines @@
 bool RenderNamedFlowThread::isChildAllowed(RenderObject* child, RenderStyle* style) const
 {
     ASSERT(child);
     ASSERT(style);
 
     if (!child->node())
         return true;
 
     ASSERT(child->node()->isElementNode());
     RenderObject* parentRenderer = NodeRenderingContext(child->node()).parentRenderer();
+    if (!parentRenderer)
+        return true;
     return parentRenderer->isChildAllowed(child, style);
 }
 
 void RenderNamedFlowThread::dispatchRegionLayoutUpdateEvent()
 {
     RenderFlowThread::dispatchRegionLayoutUpdateEvent();
     InspectorInstrumentation::didUpdateRegionLayout(document(), m_namedFlow.get());
 
     if (!m_regionLayoutUpdateEventTimer.isActive() && m_namedFlow->hasEventListeners())
         m_regionLayoutUpdateEventTimer.startOneShot(0);
@@ skipping 192 matching lines @@
                     lastEndNode = node;
                 }
             }
         }
         if (foundStartPosition || skipOverOutsideNodes)
             rangeObjects.append(range);
     }
 }
 
 }