Merge 109406

Source/WebCore/rendering/RenderObject.cpp

Index: Source/WebCore/rendering/RenderObject.cpp
===================================================================
--- Source/WebCore/rendering/RenderObject.cpp	(revision 109459)
+++ Source/WebCore/rendering/RenderObject.cpp	(working copy)
@@ -2214,6 +2214,21 @@
     return st == SelectionStart || st == SelectionEnd || st == SelectionBoth;
 }
 
+inline void RenderObject::clearLayoutRootIfNeeded() const
+{
+    if (node() && !documentBeingDestroyed() && frame()) {
+        if (FrameView* view = frame()->view()) {
+            if (view->layoutRoot() == this) {
+                ASSERT_NOT_REACHED();
+                // This indicates a failure to layout the child, which is why
+                // the layout root is still set to |this|. Make sure to clear it
+                // since we are getting destroyed.
+                view->clearLayoutRoot();
+            }
+        }
+    }
+}
+
 void RenderObject::willBeDestroyed()
 {
     // Destroy any leftover anonymous children.
@@ -2252,6 +2267,8 @@
         setHasLayer(false);
         toRenderBoxModelObject(this)->destroyLayer();
     }
+
+    clearLayoutRootIfNeeded();
 }
 
 void RenderObject::destroy()