Merge 105750 - Crash when accessing removed parent in InlineTextBox.

Source/WebCore/rendering/RenderBlock.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2007 David Smith (catfish.man@gmail.com)
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) Research In Motion Limited 2010. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 1067 matching lines @@
         RenderBlock* anonBlock = toRenderBlock(children()->removeChildNode(this, child, child->hasLayer()));
         anonBlock->moveAllChildrenTo(this, child->hasLayer());
         // Delete the now-empty block's lines and nuke it.
         anonBlock->deleteLineBoxTree();
         anonBlock->destroy();
     }
 
     if (!firstChild() && !documentBeingDestroyed()) {
         // If this was our last child be sure to clear out our line boxes.
         if (childrenInline())
-            lineBoxes()->deleteLineBoxes(renderArena());
+            deleteLineBoxTree();
     }
 }
 
 bool RenderBlock::isSelfCollapsingBlock() const
 {
     // We are not self-collapsing if we
     // (a) have a non-zero height according to layout (an optimization to avoid wasting time)
     // (b) are a table,
     // (c) have border/padding,
     // (d) have a min-height
@@ skipping 5945 matching lines @@
 }
 
 String ValueToString<RenderBlock::FloatingObject*>::string(const RenderBlock::FloatingObject* floatingObject)
 {
     return String::format("%p (%dx%d %dx%d)", floatingObject, floatingObject->x(), floatingObject->y(), floatingObject->maxX(), floatingObject->maxY());
 }
 
 #endif
 
 } // namespace WebCore