Merge WebKit at branches/chromium/742 r88085: Initial merge by git.

Change-Id: I0501b484b9528e31b0026e5ad64416dd6541cdde

1 files changed, 16 insertions, 6 deletions

diff --git a/Source/WebCore/dom/ContainerNode.cpp b/Source/WebCore/dom/ContainerNode.cpp
index 276df56..2d22fa9 100644
--- a/Source/WebCore/dom/ContainerNode.cpp
+++ b/Source/WebCore/dom/ContainerNode.cpp
@@ -534,21 +534,31 @@ void ContainerNode::removeChildren()
         m_firstChild = next;
         if (n == m_lastChild)
             m_lastChild = 0;
-
-        if (n->attached())
-            n->detach();
-
         removedChildren.append(n.release());
     }
-    allowEventDispatch();
 
     size_t removedChildrenCount = removedChildren.size();
+    size_t i;
+
+    // Detach the nodes only after properly removed from the tree because
+    // a. detaching requires a proper DOM tree (for counters and quotes for
+    // example) and during the previous loop the next sibling still points to
+    // the node being removed while the node being removed does not point back
+    // and does not point to the same parent as its next sibling.
+    // b. destroying Renderers of standalone nodes is sometimes faster.
+    for (i = 0; i < removedChildrenCount; ++i) {
+        Node* removedChild = removedChildren[i].get();
+        if (removedChild->attached())
+            removedChild->detach();
+    }
+
+    allowEventDispatch();
 
     // Dispatch a single post-removal mutation event denoting a modified subtree.
     childrenChanged(false, 0, 0, -static_cast<int>(removedChildrenCount));
     dispatchSubtreeModifiedEvent();
 
-    for (size_t i = 0; i < removedChildrenCount; ++i) {
+    for (i = 0; i < removedChildrenCount; ++i) {
         Node* removedChild = removedChildren[i].get();
         if (removedChild->inDocument())
             removedChild->removedFromDocument();