1 files changed, 10 insertions, 10 deletions
diff --git a/WebCore/html/parser/HTMLConstructionSite.cpp b/WebCore/html/parser/HTMLConstructionSite.cpp
index 0172b3d..6215bba 100644
--- a/WebCore/html/parser/HTMLConstructionSite.cpp
+++ b/WebCore/html/parser/HTMLConstructionSite.cpp
@@ -114,19 +114,19 @@ PassRefPtr<ChildType> HTMLConstructionSite::attach(ContainerNode* parent, PassRe
 
 void HTMLConstructionSite::attachAtSite(const AttachmentSite& site, PassRefPtr<Node> prpChild)
 {
+    // FIXME: It's unfortunate that we need to hold a reference to child
+    // here to call attach().  We should investigate whether we can rely on
+    // |site.parent| to hold a ref at this point.
     RefPtr<Node> child = prpChild;
 
-    if (site.nextChild) {
+    if (site.nextChild)
         site.parent->parserInsertBefore(child, site.nextChild);
-        if (site.parent->attached() && !child->attached())
-            child->attach();
-        return;
-    }
-    site.parent->parserAddChild(child);
-    // It's slightly unfortunate that we need to hold a reference to child
-    // here to call attach().  We should investigate whether we can rely on
-    // |site.parent| to hold a ref at this point.
-    if (site.parent->attached() && !child->attached())
+    else
+        site.parent->parserAddChild(child);
+
+    // JavaScript run from beforeload (or DOM Mutation or event handlers)
+    // might have removed the child, in which case we should not attach it.
+    if (child->parentNode() && site.parent->attached() && !child->attached())
         child->attach();
 }