[New Multicolumn] Destroy line box tree when evacuating the flowthread for multicol.

[New Multicolumn] Destroy line box tree when evacuating the flowthread for multicol.

The life of (in)line boxes is mysterious. They are allowed to
temporarily point to dead inline children or line box parents. It's
also allowed for InlineTextBox objects to be unrooted temporarily,
apparently. All this should be cleaned up, but for now, just do the
same in the new multicol code as everywhere else: manually take care
of deleting the line box tree before destroying the box you're
emptying.

BUG=362865
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=172054

[mstensho (USE GERRIT), 2014-04-14 10:56:14]

There is similar code here:

- RenderRubyBase::moveBlockChildren()
- RenderBlock::collapseAnonymousBlockChild()
- RenderBlock::removeChild()
and probably more

I can't help but think that we should improve move*Children*() and/or
RenderBlock::destroy() to handle this safely instead of setting such a trap for
poor programmers to stumble into, but that will probably require quite big
changes, and there could possibly be performance implications as well. So I
decided against doing that as part of this CL, and added a one-liner to the
multicol code instead.

[mstensho (USE GERRIT), 2014-04-17 19:37:14]

@esprehn, could you take a look? Seems that this will fix bug 364519 too.

[mstensho (USE GERRIT), 2014-04-21 13:52:32]

Adding more reviewers. Please take a look. This fixes a crasher.

[esprehn, 2014-04-21 16:45:02]

lgtm, indeed we need to fix the lifetime of the linebox tree. I talked to
eseidel about this, and I think all of this was done as a performance
optimization way back to avoid walking the tree repeatedly cleaning up the dead
pointers when another tree walk was going to do it "next". That seems kind of
crazy to me, especially since we keep getting security bugs down there. We
should try making the lifetime of the linebox tree simpler.

https://codereview.chromium.org/236913002/diff/1/LayoutTests/fast/multicol/in...
File LayoutTests/fast/multicol/inline-children-crash.html (right):

https://codereview.chromium.org/236913002/diff/1/LayoutTests/fast/multicol/in...
LayoutTests/fast/multicol/inline-children-crash.html:9:
document.getElementById('mc').style.WebkitColumns = 'auto';
webkitColumns works fine, you don't need the caps.

[mstensho (USE GERRIT), 2014-04-21 17:05:07]

https://codereview.chromium.org/236913002/diff/1/LayoutTests/fast/multicol/in...
File LayoutTests/fast/multicol/inline-children-crash.html (right):

https://codereview.chromium.org/236913002/diff/1/LayoutTests/fast/multicol/in...
LayoutTests/fast/multicol/inline-children-crash.html:9:
document.getElementById('mc').style.WebkitColumns = 'auto';
On 2014/04/21 16:45:02, esprehn wrote:
> webkitColumns works fine, you don't need the caps.

Weird. I thought you'd need initial upper case to distinguish it from a
hypothetical property named "webkit-columns". That's what we used to think in
Presto, at least (i.e. only capital "O" for -o- prefixed properties). Anyway:
Done.

[mstensho (USE GERRIT), 2014-04-21 17:05:11]

The CQ bit was checked by mstensho@opera.com

[commit-bot: I haz the power, 2014-04-21 17:05:18]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/mstensho@opera.com/236913002/10001

[commit-bot: I haz the power, 2014-04-21 18:13:50]

Change committed as 172054