Merge 102875 - Crash due to incorrect parsing of isolates

Source/WebCore/rendering/RenderBox.cpp

Index: Source/WebCore/rendering/RenderBox.cpp
===================================================================
--- Source/WebCore/rendering/RenderBox.cpp	(revision 103964)
+++ Source/WebCore/rendering/RenderBox.cpp	(working copy)
@@ -1477,7 +1477,10 @@
         box->destroy(renderArena());
     } else if (isReplaced()) {
         setLocation(roundedLayoutPoint(box->topLeft()));
+        // m_inlineBoxWrapper should already be 0. Deleting it is a safeguard against security issues.
         ASSERT(!m_inlineBoxWrapper);
+        if (m_inlineBoxWrapper)
+            deleteLineBoxWrapper();
         m_inlineBoxWrapper = box;
     }
 }