WebKit merge 41447:41498 [third_party/WebKit]

third_party/WebKit/WebCore/rendering/RenderWidget.cpp

 /**
  * This file is part of the HTML widget for KDE.
  *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2000 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2006 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 73 matching lines @@
     if (m_widget) {
         if (m_view)
             m_view->removeChild(m_widget);
         widgetRendererMap().remove(m_widget);
     }
     
     // removes from override size map
     if (hasOverrideSize())
         setOverrideSize(-1);
 
-    RenderArena* arena = renderArena();
-
-    if (hasLayer())
-        layer()->clearClipRects();
-
     if (style() && (style()->height().isPercent() || style()->minHeight().isPercent() || style()->maxHeight().isPercent()))
         RenderBlock::removePercentHeightDescendant(this);
 
+    if (hasLayer()) {
+        layer()->clearClipRects();
+        destroyLayer();
+    }
+
+    // Grab the arena from node()->document()->renderArena() before clearing the node pointer.
+    // Clear the node before deref-ing, as this may be deleted when deref is called.
+    RenderArena* arena = renderArena();
     setNode(0);
-
-    if (hasLayer())
-        layer()->destroy(arena);
-
     deref(arena);
 }
 
 RenderWidget::~RenderWidget()
 {
     ASSERT(m_refCount <= 0);
     deleteWidget();
 }
 
 void RenderWidget::setWidgetGeometry(const IntRect& frame)
@@ skipping 155 matching lines @@
     bool hadResult = result.innerNode();
     bool inside = RenderReplaced::nodeAtPoint(request, result, x, y, tx, ty, action);
     
     // Check to see if we are really over the widget itself (and not just in the border/padding area).
     if (inside && !hadResult && result.innerNode() == node())
         result.setIsOverWidget(contentBoxRect().contains(result.localPoint()));
     return inside;
 }
 
 } // namespace WebCore