Merge 105120 - Heap-use-after-free in WebCore::RenderBlock::selectionGaps

Source/WebCore/rendering/RenderBox.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2005 Allan Sandfeld Jensen (kde@carewolf.com)
  *           (C) 2005, 2006 Samuel Weinig (sam.weinig@gmail.com)
  * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 271 matching lines @@
                 if (!parentBlock || currBlock->containsFloat(this))
                     parentBlock = currBlock;
             }
         }
 
         if (parentBlock) {
             RenderObject* parent = parentBlock->parent();
             if (parent && parent->isDeprecatedFlexibleBox())
                 parentBlock = toRenderBlock(parent);
 
+            parentBlock->markSiblingsWithFloatsForLayout(this);
             parentBlock->markAllDescendantsWithFloatsForLayout(this, false);
         }
     }
 
     if (isPositioned()) {
         for (RenderObject* curr = parent(); curr; curr = curr->parent()) {
             if (curr->isRenderBlock())
                 toRenderBlock(curr)->removePositionedObject(this);
         }
     }
@@ skipping 3578 matching lines @@
     RenderBlock* containerBlock = containingBlock();
     if (!containerBlock || containerBlock == this)
         return locationOffset();
     
     LayoutRect rect(frameRect());
     containerBlock->flipForWritingMode(rect); // FIXME: This is wrong if we are an absolutely positioned object enclosed by a relative-positioned inline.
     return LayoutSize(rect.x(), rect.y());
 }
 
 } // namespace WebCore