Don't pass semi-detached renderers to the flow thread (or anyone else).

Source/core/rendering/RenderBlock.cpp

Index: Source/core/rendering/RenderBlock.cpp
diff --git a/Source/core/rendering/RenderBlock.cpp b/Source/core/rendering/RenderBlock.cpp
index c2f147699ece32453c77c4a9d121739cb80378c2..ae47703e1eac204e9ac2155c7634ed95972cfa19 100644
--- a/Source/core/rendering/RenderBlock.cpp
+++ b/Source/core/rendering/RenderBlock.cpp
@@ -1025,44 +1025,31 @@ void RenderBlock::removeLeftoverAnonymousBlock(RenderBlock* child)
 {
     ASSERT(child->isAnonymousBlock());
     ASSERT(!child->childrenInline());
+    ASSERT(child->parent() == this);
 
     if (child->continuation() || (child->firstChild() && (child->isAnonymousColumnSpanBlock() || child->isAnonymousColumnsBlock())))
         return;
 
-    LayoutObject* firstAnChild = child->m_children.firstChild();
-    LayoutObject* lastAnChild = child->m_children.lastChild();
-    if (firstAnChild) {
-        LayoutObject* o = firstAnChild;
-        while (o) {
+    // Promote all the leftover anonymous block's children (to become children of this block
+    // instead). Put them right after the leftover block. We still want to keep the leftover block
+    // in the tree for a moment, for notification purposes done further below (flow threads and
+    // grids).
+    if (LayoutObject* firstPromotee = child->firstChild()) {
+        LayoutObject* lastPromotee = child->lastChild();
+        LayoutObject* nextSiblingOfPromotees = child->nextSibling();
+        for (LayoutObject* o = firstPromotee; o; o = o->nextSibling())
             o->setParent(this);
-            o = o->nextSibling();
-        }
-        firstAnChild->setPreviousSibling(child->previousSibling());
-        lastAnChild->setNextSibling(child->nextSibling());
-        if (child->previousSibling())
-            child->previousSibling()->setNextSibling(firstAnChild);
-        if (child->nextSibling())
-            child->nextSibling()->setPreviousSibling(lastAnChild);
-
-        if (child == m_children.firstChild())
-            m_children.setFirstChild(firstAnChild);
-        if (child == m_children.lastChild())
-            m_children.setLastChild(lastAnChild);
-    } else {
-        if (child == m_children.firstChild())
-            m_children.setFirstChild(child->nextSibling());
-        if (child == m_children.lastChild())
-            m_children.setLastChild(child->previousSibling());
-
-        if (child->previousSibling())
-            child->previousSibling()->setNextSibling(child->nextSibling());
-        if (child->nextSibling())
-            child->nextSibling()->setPreviousSibling(child->previousSibling());
+        child->children()->setFirstChild(0);
+        child->children()->setLastChild(0);

[dsinclair, 2015/02/17 18:25:01]

nit: change the 0's to nullptrs

[mstensho (USE GERRIT), 2015/02/18 20:02:25]

Done.

+        firstPromotee->setPreviousSibling(child);
+        child->setNextSibling(firstPromotee);
+        lastPromotee->setNextSibling(nextSiblingOfPromotees);
+        if (nextSiblingOfPromotees)
+            nextSiblingOfPromotees->setPreviousSibling(lastPromotee);
+        if (children()->lastChild() == child)
+            children()->setLastChild(lastPromotee);
     }
 
-    child->children()->setFirstChild(0);
-    child->m_next = nullptr;
-
     // Remove all the information in the flow thread associated with the leftover anonymous block.
     child->removeFromLayoutFlowThread();
 
@@ -1070,10 +1057,10 @@ void RenderBlock::removeLeftoverAnonymousBlock(RenderBlock* child)
     if (child->parent()->isRenderGrid())
         toRenderGrid(child->parent())->dirtyGrid();
 
-    child->setParent(0);
-    child->setPreviousSibling(0);
-    child->setNextSibling(0);
-
+    // Now remove the leftover anonymous block from the tree, and destroy it. We'll rip it out
+    // manually from the tree before destroying it, because we don't want to trigger any tree
+    // adjustments with regards to anonymous blocks (or any other kind of undesired chain-reaction).
+    children()->removeChildNode(this, child, false);
     child->destroy();
 }