Merge 133717

Source/WebCore/rendering/RenderButton.cpp

 /**
  * Copyright (C) 2005 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ skipping 42 matching lines @@
         m_inner = createAnonymousBlock(style()->display());
         setupInnerStyle(m_inner->style());
         RenderDeprecatedFlexibleBox::addChild(m_inner);
     }
     
     m_inner->addChild(newChild, beforeChild);
 }
 
 void RenderButton::removeChild(RenderObject* oldChild)
 {
-    if (oldChild == m_inner || !m_inner) {
+    // m_inner should be the only child, but checking for direct children who
+    // are not m_inner prevents security problems when that assumption is
+    // violated.
+    if (oldChild == m_inner || !m_inner || oldChild->parent() == this) {
+        ASSERT(oldChild == m_inner || !m_inner);
         RenderDeprecatedFlexibleBox::removeChild(oldChild);
         m_inner = 0;
     } else
         m_inner->removeChild(oldChild);
 }
 
 void RenderButton::styleWillChange(StyleDifference diff, const RenderStyle* newStyle)
 {
     if (m_inner) {
         // RenderBlock::setStyle is going to apply a new style to the inner block, which
@@ skipping 95 matching lines @@
     // enters the page cache. But we currently have no way of being notified
     // when that happens, so we'll just ignore the timer firing as long as
     // we're in the cache.
     if (document()->inPageCache())
         return;
 
     repaint();
 }
 
 } // namespace WebCore