Try to fix crash because of InlineBox deletion in a cached subsequence

third_party/WebKit/Source/core/layout/line/InlineBox.cpp

 /*
  * Copyright (C) 2003, 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ skipping 49 matching lines @@
 
 #endif
 
 void InlineBox::destroy()
 {
     // We do not need to issue invalidations if the page is being destroyed
     // since these objects will never be repainted.
     if (!m_lineLayoutItem.documentBeingDestroyed()) {
         setLineLayoutItemShouldDoFullPaintInvalidationIfNeeded();
 
-#if CHECK_DISPLAY_ITEM_CLIENT_ALIVENESS
-        // This object may have display items in a cached subsequence, but we are
-        // sure that the subsequence will be invalidated because m_lineLayoutItem has
-        // been setShouldFullPaintInvalidation(), so deletion of this object is safe.
-        endShouldKeepAlive();
-#endif
+        // TODO(crbug.com/619630): Make this fast.
+        m_lineLayoutItem.slowSetPaintingLayerNeedsRepaint();
     }
 
     delete this;
 }
 
 void InlineBox::remove(MarkLineBoxes markLineBoxes)
 {
     if (parent())
         parent()->removeChild(this, markLineBoxes);
 }
@@ skipping 337 matching lines @@
 
 void showLineTree(const blink::InlineBox* b)
 {
     if (b)
         b->showLineTreeForThis();
     else
         fprintf(stderr, "Cannot showLineTree for (nil) InlineBox.\n");
 }
 
 #endif