CSSRegions: crash positioned object with inline containing block in flow thread
https://bugs.webkit.org/show_bug.cgi?id=108307

Reviewed by David Hyatt.

Source/WebCore:

The fix for https://bugs.webkit.org/show_bug.cgi?id=69896 allowed positioned blocks work
with variable width regions. However, the information needed for that is available only
when the container used for positioning is a block.

This patch ensures we are using this solution only when the container used for positioning
is a block. This needs to be revisited when we will extend support for other types of boxes
as mentioned in RenderBox::renderBoxRegionInfo.

Test: fast/regions/positioned-object-inline-cb-crash.html

* rendering/RenderBox.cpp:
(WebCore::RenderBox::renderBoxRegionInfo):
(WebCore::RenderBox::containingBlockLogicalWidthForPositioned):
(WebCore::RenderBox::computePositionedLogicalWidth): Make sure we are using containerBlocks
that are blocks. Add an assert that the type of containerBlock we are using can have
computed RenderBoxRegionInfo.
(WebCore::RenderBox::computePositionedLogicalHeight):
* rendering/RenderBoxModelObject.h:
(WebCore::RenderBoxModelObject::canHaveBoxInfoInRegion): This helper method
will return the boxes that may have computed RenderBoxRegionInfo. Currently,
returns true for blocks only.

LayoutTests:

* fast/regions/positioned-object-inline-cb-crash-expected.txt: Added.
* fast/regions/positioned-object-inline-cb-crash.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@143312 268f45cc-cd09-0410-ab3c-d52691b4dbfc