Reviewed by Hyatt.

        Test for <rdar://problem/5403773>
        CrashTracer: [USER] 88 crashes in Safari at com.apple.WebCore: WebCore::RenderTableSection::paint + 846
        
        Changed results for fast/dynamic/containing-block-change.html are progression
        (even though new results don't match Firefox and old ones did!)

        * fast/dynamic/ancestor-to-absolute-expected.txt: Added.
        * fast/dynamic/ancestor-to-absolute.html: Added.
        * fast/dynamic/containing-block-change-expected.checksum:
        * fast/dynamic/containing-block-change-expected.png:
        * fast/dynamic/containing-block-change-expected.txt:

WebCore:

        Reviewed by Hyatt.
        
        Fix <rdar://problem/5403773>
        CrashTracer: [USER] 88 crashes in Safari at com.apple.WebCore: WebCore::RenderTableSection::paint + 846

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::removePositionedObjects):
        
        Fix crash in http://www.infobae.com/interior/home.html
        Positioned objects removed from m_positionedObjects would in some cases not get added back to any 
        positioned objects list. Adding objects happens in block layout but since layout was not invalidated 
        correctly in removePositionedObjects() it would not get invoked. As a result some positioned objects 
        would stay in layout dirty state leading to crashes and other bad things.
        
        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::paint):
        
        Add needLayout() guard to eliminate this class of crashes from release builds. 
        Assert commented out for now since one existing layout test can't handle it.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@25132 268f45cc-cd09-0410-ab3c-d52691b4dbfc