Merge 76859

Source/WebCore/rendering/RenderObject.cpp

Index: Source/WebCore/rendering/RenderObject.cpp
===================================================================
--- Source/WebCore/rendering/RenderObject.cpp	(revision 79927)
+++ Source/WebCore/rendering/RenderObject.cpp	(working copy)
@@ -316,7 +316,6 @@
         // Just add it...
         children->insertChildNode(this, newChild, beforeChild);
     }
-    RenderCounter::rendererSubtreeAttached(newChild); 
     if (newChild->isText() && newChild->style()->textTransform() == CAPITALIZE) {
         RefPtr<StringImpl> textToTransform = toRenderText(newChild)->originalText();
         if (textToTransform)
@@ -2154,9 +2153,6 @@
     if (frame() && frame()->eventHandler()->autoscrollRenderer() == this)
         frame()->eventHandler()->stopAutoscrollTimer(true);
 
-    if (m_hasCounterNodeMap)
-        RenderCounter::destroyCounterNodes(this);
-
     if (AXObjectCache::accessibilityEnabled()) {
         document()->axObjectCache()->childrenChanged(this->parent());
         document()->axObjectCache()->remove(this);
@@ -2169,6 +2165,14 @@
 
     remove();
 
+    // If this renderer had a parent, remove should have destroyed any counters
+    // attached to this renderer and marked the affected other counters for
+    // reevaluation. This apparently redundant check is here for the case when
+    // this renderer had no parent at the time remove() was called.
+
+    if (m_hasCounterNodeMap)
+        RenderCounter::destroyCounterNodes(this);
+
     // FIXME: Would like to do this in RenderBoxModelObject, but the timing is so complicated that this can't easily
     // be moved into RenderBoxModelObject::destroy.
     if (hasLayer()) {