am ffe27b58: Integrate WebKit security fix http://trac.webkit.org/changeset/50466

Merge commit 'ffe27b58c77e71641efd3bd4258323cd4c29c39a' into eclair-mr2

* commit 'ffe27b58c77e71641efd3bd4258323cd4c29c39a':
  Integrate WebKit security fix

1 files changed, 10 insertions, 7 deletions

diff --git a/WebCore/rendering/RenderBlock.cpp b/WebCore/rendering/RenderBlock.cpp
index 902a5b3..7040e06 100644
--- a/WebCore/rendering/RenderBlock.cpp
+++ b/WebCore/rendering/RenderBlock.cpp
@@ -167,14 +167,17 @@ RenderBlock::~RenderBlock()
 
 void RenderBlock::destroy()
 {
-    // Detach our continuation first.
-    if (m_inlineContinuation)
+    // Make sure to destroy anonymous children first while they are still connected to the rest of the tree, so that they will 
+    // properly dirty line boxes that they are removed from. Effects that do :before/:after only on hover could crash otherwise. 
+    children()->destroyLeftoverChildren(); 
+
+    // Destroy our continuation before anything other than anonymous children. 
+    // The reason we don't destroy it before anonymous children is that they may 
+    // have continuations of their own that are anonymous children of our continuation. 
+    if (m_inlineContinuation) { 
         m_inlineContinuation->destroy();
-    m_inlineContinuation = 0;
-    
-    // Make sure to destroy anonymous children first while they are still connected to the rest of the tree, so that they will
-    // properly dirty line boxes that they are removed from.  Effects that do :before/:after only on hover could crash otherwise.
-    children()->destroyLeftoverChildren();
+        m_inlineContinuation = 0; 
+    }
 
     if (!documentBeingDestroyed()) {
         if (firstLineBox()) {