miscreation of inline flow boxes in render lists

[Leo Savernik]

Hello,

I stumbled across the following bug on inline flow boxes in conjunction with 
render lists.

Given a list like
<ul>
<li>bli
<li>blu
</ul>

will create the following inline box representation for <li>bli:

RootInlineBox:
  InlineBox: object = <nil> (!)
  InlineTextBox: object = RenderText("blu")

First problem: the first inline box's object is nil. Is that possible at all? 
From my understanding of the code, this is absolutely forbidden.

Second problem: The inline text box refers to the RenderText of the *last* 
item, i. e. <li>blu. Regardless of how long the list is, all <li>s' root line 
boxes refer to the inline text box of the last <li>.
(However, the correct inline text boxes can still be obtained by the 
RenderText's InlineTextBoxArray).

Does WebCore exhibit the same bug?

Otherwise, it is probably a bug due to merging.

mfg
	Leo