WebKit merge 41447:41498 [third_party/WebKit]

third_party/WebKit/WebCore/rendering/RenderWidget.cpp

Index: third_party/WebKit/WebCore/rendering/RenderWidget.cpp
===================================================================
--- third_party/WebKit/WebCore/rendering/RenderWidget.cpp	(revision 11154)
+++ third_party/WebKit/WebCore/rendering/RenderWidget.cpp	(working copy)
@@ -91,19 +91,18 @@
     if (hasOverrideSize())
         setOverrideSize(-1);
 
-    RenderArena* arena = renderArena();
-
-    if (hasLayer())
-        layer()->clearClipRects();
-
     if (style() && (style()->height().isPercent() || style()->minHeight().isPercent() || style()->maxHeight().isPercent()))
         RenderBlock::removePercentHeightDescendant(this);
 
-    setNode(0);
+    if (hasLayer()) {
+        layer()->clearClipRects();
+        destroyLayer();
+    }
 
-    if (hasLayer())
-        layer()->destroy(arena);
-
+    // Grab the arena from node()->document()->renderArena() before clearing the node pointer.
+    // Clear the node before deref-ing, as this may be deleted when deref is called.
+    RenderArena* arena = renderArena();
+    setNode(0);
     deref(arena);
 }