REGRESSION (r168046): Crash in WebCore::InlineBox::renderer / WebCore::RenderFlowThre...

REGRESSION (r168046): Crash in WebCore::InlineBox::renderer / WebCore::RenderFlowThread::checkLinesConsistency
https://bugs.webkit.org/show_bug.cgi?id=133462

Reviewed by David Hyatt.

RenderFlowThread::m_lineToRegionMap stores pointers to the root inlineboxes in the block flow.
Normally root inlineboxes remove themselves from this map in their dtors. However when collapsing an anonymous block,
we detach the inline tree first and destroy them after. The detached root boxes can't access
the flowthread containing block and we end up with dangling pointers in this map.
Call removeFlowChildInfo() before detaching the subtree to ensure proper pointer removal.

Source/WebCore:

Test: fast/multicol/newmulticol/crash-when-switching-to-floating.html

* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::collapseAnonymousBoxChild):

LayoutTests:

* fast/multicol/newmulticol/crash-when-switching-to-floating-expected.txt: Added.
* fast/multicol/newmulticol/crash-when-switching-to-floating.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@179877 268f45cc-cd09-0410-ab3c-d52691b4dbfc