Heap-use-after-free in WebCore::RenderObject::isDescendantOf
https://bugs.webkit.org/show_bug.cgi?id=107226

Reviewed by Emil A Eklund.

Source/WebCore:

Test: fast/block/float/overhanging-float-not-removed-crash.html

* rendering/RenderBox.cpp:
(WebCore::RenderBox::removeFloatingOrPositionedChildFromBlockLists):
Skip anonymous blocks in the chain to get the enclosing block and
be able to correctly mark the overhanging floats in the next siblings.

LayoutTests:

* fast/block/float/overhanging-float-not-removed-crash-expected.txt: Added.
* fast/block/float/overhanging-float-not-removed-crash.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@140435 268f45cc-cd09-0410-ab3c-d52691b4dbfc