Merge 86358 - 2011-05-12 Carol Szabo <carol@webkit.org>

Source/WebCore/dom/ContainerNode.cpp

Index: Source/WebCore/dom/ContainerNode.cpp
===================================================================
--- Source/WebCore/dom/ContainerNode.cpp	(revision 86864)
+++ Source/WebCore/dom/ContainerNode.cpp	(working copy)
@@ -534,21 +534,31 @@
         m_firstChild = next;
         if (n == m_lastChild)
             m_lastChild = 0;
+        removedChildren.append(n.release());
+    }
 
-        if (n->attached())
-            n->detach();
+    size_t removedChildrenCount = removedChildren.size();
+    size_t i;
 
-        removedChildren.append(n.release());
+    // Detach the nodes only after properly removed from the tree because
+    // a. detaching requires a proper DOM tree (for counters and quotes for
+    // example) and during the previous loop the next sibling still points to
+    // the node being removed while the node being removed does not point back
+    // and does not point to the same parent as its next sibling.
+    // b. destroying Renderers of standalone nodes is sometimes faster.
+    for (i = 0; i < removedChildrenCount; ++i) {
+        Node* removedChild = removedChildren[i].get();
+        if (removedChild->attached())
+            removedChild->detach();
     }
+
     allowEventDispatch();
 
-    size_t removedChildrenCount = removedChildren.size();
-
     // Dispatch a single post-removal mutation event denoting a modified subtree.
     childrenChanged(false, 0, 0, -static_cast<int>(removedChildrenCount));
     dispatchSubtreeModifiedEvent();
 
-    for (size_t i = 0; i < removedChildrenCount; ++i) {
+    for (i = 0; i < removedChildrenCount; ++i) {
         Node* removedChild = removedChildren[i].get();
         if (removedChild->inDocument())
             removedChild->removedFromDocument();