Merge 101584 - Crash from first letter text fragments having flows split

Source/WebCore/rendering/RenderBlock.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2007 David Smith (catfish.man@gmail.com)
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) Research In Motion Limited 2010. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 5600 matching lines @@
             RenderTextFragment* remainingText = 0;
             RenderObject* nextSibling = firstLetter->nextSibling();
             RenderObject* next = nextSibling;
             while (next) {
                 if (next->isText() && toRenderText(next)->isTextFragment()) {
                     remainingText = toRenderTextFragment(next);
                     break;
                 }
                 next = next->nextSibling();
             }
+            if (!remainingText && firstLetterContainer->isAnonymousBlock()) {
+                // The remaining text fragment could have been wrapped in a different anonymous block since creation
+                RenderObject* nextChild;
+                next = firstLetterContainer->nextSibling();
+                while (next && !remainingText) {
+                    if (next->isAnonymousBlock()) {
+                        nextChild = next->firstChild();
+                        while (nextChild) {
+                            if (nextChild->isText() && toRenderText(nextChild)->isTextFragment()
+                                && (toRenderTextFragment(nextChild)->firstLetter() == firstLetter)) {
+                                remainingText = toRenderTextFragment(nextChild);
+                                break;
+                            }
+                            nextChild = nextChild->nextSibling();
+                        }
+                    } else
+                        break;
+                    next = next->nextSibling();
+                }
+            }
             if (remainingText) {
                 ASSERT(remainingText->isAnonymous() || remainingText->node()->renderer() == remainingText);
                 // Replace the old renderer with the new one.
                 remainingText->setFirstLetter(newFirstLetter);
             }
             firstLetter->destroy();
             firstLetter = newFirstLetter;
             firstLetterContainer->addChild(firstLetter, nextSibling);
         } else
             firstLetter->setStyle(pseudoStyle);
@@ skipping 1282 matching lines @@
 }
 
 String ValueToString<RenderBlock::FloatingObject*>::string(const RenderBlock::FloatingObject* floatingObject)
 {
     return String::format("%p (%dx%d %dx%d)", floatingObject, floatingObject->x(), floatingObject->y(), floatingObject->maxX(), floatingObject->maxY());
 }
 
 #endif
 
 } // namespace WebCore