Merge 112596 - Heap-use-after-free in WebCore::InlineFlowBox::deleteLine due to fullscreen issues.

Source/WebCore/rendering/RenderFullScreen.cpp

Index: Source/WebCore/rendering/RenderFullScreen.cpp
===================================================================
--- Source/WebCore/rendering/RenderFullScreen.cpp	(revision 112636)
+++ Source/WebCore/rendering/RenderFullScreen.cpp	(working copy)
@@ -113,8 +113,10 @@
         if (RenderObject* parent = object->parent()) {
             parent->addChild(fullscreenRenderer, object);
             object->remove();
+            parent->setNeedsLayoutAndPrefWidthsRecalc();
         }
         fullscreenRenderer->addChild(object);
+        fullscreenRenderer->setNeedsLayoutAndPrefWidthsRecalc();
     }
     document->setFullScreenRenderer(fullscreenRenderer);
     return fullscreenRenderer;
@@ -127,6 +129,7 @@
         while ((child = firstChild())) {
             child->remove();
             parent()->addChild(child, this);
+            parent()->setNeedsLayoutAndPrefWidthsRecalc();
         }
     }
     if (placeholder())
@@ -150,8 +153,10 @@
     if (!m_placeholder) {
         m_placeholder = new (document()->renderArena()) RenderFullScreenPlaceholder(this);
         m_placeholder->setStyle(style);
-        if (parent())
+        if (parent()) {
             parent()->addChild(m_placeholder, this);
+            parent()->setNeedsLayoutAndPrefWidthsRecalc();
+        }
     } else
         m_placeholder->setStyle(style);
 }