Merge 104123 - Crash due to first-letter block processing

Source/WebCore/rendering/RenderBlock.cpp

Index: Source/WebCore/rendering/RenderBlock.cpp
===================================================================
--- Source/WebCore/rendering/RenderBlock.cpp	(revision 105348)
+++ Source/WebCore/rendering/RenderBlock.cpp	(working copy)
@@ -5616,38 +5616,14 @@
 
             RenderTextFragment* remainingText = 0;
             RenderObject* nextSibling = firstLetter->nextSibling();
-            RenderObject* next = nextSibling;
-            while (next) {
-                if (next->isText() && toRenderText(next)->isTextFragment()) {
-                    remainingText = toRenderTextFragment(next);
-                    break;
-                }
-                next = next->nextSibling();
-            }
-            if (!remainingText && firstLetterContainer->isAnonymousBlock()) {
-                // The remaining text fragment could have been wrapped in a different anonymous block since creation
-                RenderObject* nextChild;
-                next = firstLetterContainer->nextSibling();
-                while (next && !remainingText) {
-                    if (next->isAnonymousBlock()) {
-                        nextChild = next->firstChild();
-                        while (nextChild) {
-                            if (nextChild->isText() && toRenderText(nextChild)->isTextFragment()
-                                && (toRenderTextFragment(nextChild)->firstLetter() == firstLetter)) {
-                                remainingText = toRenderTextFragment(nextChild);
-                                break;
-                            }
-                            nextChild = nextChild->nextSibling();
-                        }
-                    } else
-                        break;
-                    next = next->nextSibling();
-                }
-            }
+            RenderObject* remainingTextObject = toRenderBoxModelObject(firstLetter)->firstLetterRemainingText();
+            if (remainingTextObject && remainingTextObject->isText() && toRenderText(remainingTextObject)->isTextFragment())
+                remainingText = toRenderTextFragment(remainingTextObject);
             if (remainingText) {
                 ASSERT(remainingText->isAnonymous() || remainingText->node()->renderer() == remainingText);
                 // Replace the old renderer with the new one.
                 remainingText->setFirstLetter(newFirstLetter);
+                toRenderBoxModelObject(newFirstLetter)->setFirstLetterRemainingText(remainingText);
             }
             firstLetter->destroy();
             firstLetter = newFirstLetter;
@@ -5725,6 +5701,7 @@
         firstLetterContainer->addChild(remainingText, textObj);
         firstLetterContainer->removeChild(textObj);
         remainingText->setFirstLetter(firstLetter);
+        toRenderBoxModelObject(firstLetter)->setFirstLetterRemainingText(remainingText);
         
         // construct text fragment for the first letter
         RenderTextFragment* letter =