Harden column splitting code against bad casts.
Harden column splitting code against bad casts.

Make sure that |curr| is a descendant of |fromBlock|. We need to check in every iteration of the loop because moveChildrenTo could have moved |curr|. This is a mitigation and not really a fix against a class of tree craziness.

BUG=189089
TEST=none since current fuzzed testcase does not minimize

Review URL: https://codereview.chromium.org/13852041

git-svn-id: bf5cd6ccde378db821296732a091cfbcf5285fbd@148760 bbb929c8-8fbe-4397-9dbb-9b2b20218538

primiano/blink-gitcs,primiano/blink-gitcs,primiano/blink-gitcs,primiano/blink-gitcs,primiano/blink-gitcs,primiano/blink-gitcs,primiano/blink-gitcs,primiano/blink-gitcs,primiano/blink-gitcs