Don't delete a flow thread just because it becomes childless.

Source/core/rendering/RenderObject.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Dirk Mueller (mueller@kde.org)
  *           (C) 2004 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2009 Google Inc. All rights reserved.
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
@@ skipping 2382 matching lines @@
     if (documentBeingDestroyed()) {
         destroy();
         return;
     }
 
     RenderObject* destroyRoot = this;
     for (RenderObject* destroyRootParent = destroyRoot->parent(); destroyRootParent && destroyRootParent->isAnonymous(); destroyRoot = destroyRootParent, destroyRootParent = destroyRootParent->parent()) {
         // Anonymous block continuations are tracked and destroyed elsewhere (see the bottom of RenderBlock::removeChild)
         if (destroyRootParent->isRenderBlock() && toRenderBlock(destroyRootParent)->isAnonymousBlockContinuation())
             break;
-        // Column spans are tracked elsewhere, so we can't destroy them here.
-        if (destroyRootParent->isAnonymousColumnSpanBlock())
+        // A flow thread is tracked by its containing block. Whether its children are removed or not is irrelevant.
+        // Column spans are tracked elsewhere.
+        if (destroyRootParent->isRenderFlowThread() || destroyRootParent->isAnonymousColumnSpanBlock())

[Julien - ping for review, 2014/12/03 23:05:00]

I would keep the 2 conditions separated as it would make it more obvious which
comments refers to what.

[mstensho (USE GERRIT), 2014/12/04 06:57:06]

Done.

             break;
 
         if (destroyRootParent->slowFirstChild() != destroyRoot || destroyRootParent->slowLastChild() != destroyRoot)
             break; // Need to keep the anonymous parent, since it won't become empty by the removal of this renderer.
     }
 
     destroyRoot->destroy();
 
     // WARNING: |this| is deleted here.
 }
@@ skipping 702 matching lines @@
 {
     if (object1) {
         const blink::RenderObject* root = object1;
         while (root->parent())
             root = root->parent();
         root->showRenderTreeAndMark(object1, "*", object2, "-", 0);
     }
 }
 
 #endif