Cherry-pick WebKit change r90068 to fix a rendering crash

Note that this change does not apply cleanly in RenderBlock::destroy() without
r85869.

r85869 was intended to be an optimization only, with no functional change.
However, it introduced two crashes, one of which is fixed in r90068 and the
other in r86060. To avoid the need to cherry-pick both r85869 and r86060 as
prerequisites, the patch for r90068 was applied manually to give the correct
end result in RenderBlock::destroy().

We now pass the LayoutTests added in r90068 and the LayoutTest added in r86060
does not crash.

See http://trac.webkit.org/changeset/90068

Bug: 5496903
Change-Id: Ica6dc2c70a4cd5c781ae77df95a8a4033c097708

4 files changed, 15 insertions, 1 deletions

diff --git a/Source/WebCore/rendering/RenderBlock.cpp b/Source/WebCore/rendering/RenderBlock.cpp
index a90bf69..42d68a0 100644
--- a/Source/WebCore/rendering/RenderBlock.cpp
+++ b/Source/WebCore/rendering/RenderBlock.cpp
@@ -191,7 +191,7 @@ void RenderBlock::destroy()
                         childBox->remove();
                 }
             }
-        } else if (isInline() && parent())
+        } else if (parent())
             parent()->dirtyLinesFromChangedChild(this);
     }
 
diff --git a/Source/WebCore/rendering/RenderReplaced.cpp b/Source/WebCore/rendering/RenderReplaced.cpp
index c27d336..09a7944 100644
--- a/Source/WebCore/rendering/RenderReplaced.cpp
+++ b/Source/WebCore/rendering/RenderReplaced.cpp
@@ -57,6 +57,14 @@ RenderReplaced::~RenderReplaced()
 {
 }
 
+void RenderReplaced::destroy()
+{
+    if (!documentBeingDestroyed() && parent())
+        parent()->dirtyLinesFromChangedChild(this);
+
+    RenderBox::destroy();
+}
+
 void RenderReplaced::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
 {
     RenderBox::styleDidChange(diff, oldStyle);
diff --git a/Source/WebCore/rendering/RenderReplaced.h b/Source/WebCore/rendering/RenderReplaced.h
index d6ebba6..29fc71c 100644
--- a/Source/WebCore/rendering/RenderReplaced.h
+++ b/Source/WebCore/rendering/RenderReplaced.h
@@ -32,6 +32,8 @@ public:
     RenderReplaced(Node*, const IntSize& intrinsicSize);
     virtual ~RenderReplaced();
 
+    virtual void destroy();
+
 protected:
     virtual void layout();
 
diff --git a/Source/WebCore/rendering/RenderWidget.cpp b/Source/WebCore/rendering/RenderWidget.cpp
index 894d689..97444cd 100644
--- a/Source/WebCore/rendering/RenderWidget.cpp
+++ b/Source/WebCore/rendering/RenderWidget.cpp
@@ -125,6 +125,10 @@ void RenderWidget::destroy()
         document()->axObjectCache()->childrenChanged(this->parent());
         document()->axObjectCache()->remove(this);
     }
+
+    if (!documentBeingDestroyed() && parent()) 
+        parent()->dirtyLinesFromChangedChild(this);
+
     remove();
 
     if (m_hasCounterNodeMap)