https://bugs.webkit.org/show_bug.cgi?id=115925

Patch by Bem Jones-Bey <bjonesbe@adobe.com> on 2013-05-13
Reviewed by David Hyatt.

Allowing floats to overhand from flex items is not only against the
spec, it causes bad bugs. Fix this by having flex items properly avoid
floats.

Test: fast/block/float/float-not-removed-crash2.html

* rendering/RenderBox.cpp:
(WebCore::RenderBox::avoidsFloats): Add flex items to avoid floats.
* rendering/RenderBox.h:
(WebCore::RenderBox::isFlexItemIncludingDeprecated): Determine if the current box is a
    flex item or deprecated flex item.

LayoutTests: Fix the float logic to not return an anonymous block ancestor
https://bugs.webkit.org/show_bug.cgi?id=115925

Patch by Bem Jones-Bey <bjonesbe@adobe.com> on 2013-05-13
Reviewed by David Hyatt.

Cleaned up fuzzer test. Note that this will only crash when run under
a memory checker like ASAN.

* fast/block/float/float-not-removed-crash2-expected.txt: Added.
* fast/block/float/float-not-removed-crash2.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@150029 268f45cc-cd09-0410-ab3c-d52691b4dbfc