[CSS Regions] Assertion in RenderFlowThread::removeRenderBoxRegionInfo
https://bugs.webkit.org/show_bug.cgi?id=109914

Reviewed by David Hyatt.

Source/WebCore:

This patch moves a part of the invalidation operations inside the RenderFlowThread::invalidateRegions call. The maps
are cleared anyway at layout time but doing this earlier makes sure the flow thread is in a more consistent state
(the RenderFlowThread object has both the region chain invalidated and the regions information cleared).

RenderFlowThread::removeRenderBoxRegionInfo will check if the region chain is invalidated. If true, it means the
flow thread has a layout scheduled and the regions information is not yet reliable. In this case we just return from the
function and wait for the layout to cleanup the box information.

Test: fast/regions/remove-box-info-assert.html

* rendering/RenderFlowThread.cpp:
(WebCore::RenderFlowThread::removeRegionFromThread):
(WebCore::RenderFlowThread::invalidateRegions):
(WebCore):
(WebCore::RenderFlowThread::layout):
(WebCore::RenderFlowThread::removeRenderBoxRegionInfo):
* rendering/RenderFlowThread.h:
* rendering/RenderNamedFlowThread.cpp:
(WebCore::RenderNamedFlowThread::removeRegionFromThread):

LayoutTests:

The test creates a flow thread with two regions and a content node. We remove the region and the node from the flow thread
at the same time. When the style is updated, the region is first removed from the chain and range information for boxes
is cleared from the flow thread. When the node is removed from the flow thread it tries to delete its region box information.
The range information on the flow thread is gone so the range for the node's box is zero - nothing gets deleted. Afterwards,
an ASSERT is triggered because there's leftover box information inside the region chain.

* fast/regions/remove-box-info-assert-expected.txt: Added.
* fast/regions/remove-box-info-assert.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@143322 268f45cc-cd09-0410-ab3c-d52691b4dbfc