2009-03-09  Alpha Lam  <hclam@chromium.org>

        Reviewed by Dave Hyatt.

        https://bugs.webkit.org/show_bug.cgi?id=23024

        Fix an incorrect criteria in the if statement that leaves references to
        deleted floating objects in RenderBlock.

        Test: fast/block/float/crash-on-absolute-positioning.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::markAllDescendantsWithFloatsForLayout):

LayoutTests:

2009-03-09  Alpha Lam  <hclam@chromium.org>

        Reviewed by Dave Hyatt.

        https://bugs.webkit.org/show_bug.cgi?id=23024

        Added regression test for a bug that causes crashes.

        * fast/block/float/crash-on-absolute-positioning.html: Added.
        * platform/mac/fast/block/float/crash-on-absolute-positioning-expected.txt: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@41537 268f45cc-cd09-0410-ab3c-d52691b4dbfc