Don't pass semi-detached renderers to the flow thread (or anyone else).

Source/core/layout/LayoutBlock.h

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2007 David Smith (catfish.man@gmail.com)
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 314 matching lines @@
 
 private:
     virtual LayoutObjectChildList* virtualChildren() override final { return children(); }
     virtual const LayoutObjectChildList* virtualChildren() const override final { return children(); }
 
     virtual const char* renderName() const override;
 
     virtual bool isLayoutBlock() const override final { return true; }
 
     void makeChildrenNonInline(LayoutObject* insertionPoint = 0);
+
+    // Promote all children and make them siblings that come right after this block.
+    void promoteAllChildrenAndInsertAfter();
+
     virtual void removeLeftoverAnonymousBlock(LayoutBlock* child);
 
     static void collapseAnonymousBlockChild(LayoutBlock* parent, LayoutBlock* child);
 
     virtual void dirtyLinesFromChangedChild(LayoutObject* child) override final { m_lineBoxes.dirtyLinesFromChangedChild(this, child); }
 
     void addChildToContinuation(LayoutObject* newChild, LayoutObject* beforeChild);
     virtual void addChildIgnoringContinuation(LayoutObject* newChild, LayoutObject* beforeChild) override;
     void addChildToAnonymousColumnBlocks(LayoutObject* newChild, LayoutObject* beforeChild);
 
@@ skipping 128 matching lines @@
     // FIXME: This is temporary as we move code that accesses block flow
     // member variables out of LayoutBlock and into LayoutBlockFlow.
     friend class LayoutBlockFlow;
 };
 
 DEFINE_LAYOUT_OBJECT_TYPE_CASTS(LayoutBlock, isLayoutBlock());
 
 } // namespace blink
 
 #endif // LayoutBlock_h