WebCore:

WebCore:

        Reviewed by Darin Adler.

        - fix <rdar://problem/5619240> REGRESSION (Leopard-r28069): Reproducible crash with a Mootools-based calendar picker (jump to null in FrameView::layout)

        Test: fast/dynamic/subtree-common-root.html

        * page/FrameView.cpp:
        (WebCore::FrameView::layoutRoot): Added a parameter to let this method
        return the layout root for a pending layout as well.
        (WebCore::FrameView::scheduleRelayoutOfSubtree): Pass the new root
        to markContainingBlocksForLayout(). Otherwise,
        markContainingBlocksForLayout() could mark past the new root, if it had
        previously been marked as having a normal child needing layout and then
        was reached via a positioned child.
        * page/FrameView.h:
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::calcWidth):
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::~RenderObject): Fixed the ASSERT so that
        it would really catch deletion of the layout root.
        (WebCore::RenderObject::markContainingBlocksForLayout): Added the
        newRoot parameter, which tells this method where to stop marking.
        * rendering/RenderObject.h:

LayoutTests:

        Reviewed by Darin Adler.

        - test for <rdar://problem/5619240> REGRESSION (Leopard-r28069): Reproducible crash with a Mootools-based calendar picker (jump to null in FrameView::layout)

        * fast/dynamic/subtree-common-root-expected.txt: Added.
        * fast/dynamic/subtree-common-root.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@28299 268f45cc-cd09-0410-ab3c-d52691b4dbfc