Merge 133717

Source/WebCore/rendering/RenderButton.cpp

Index: Source/WebCore/rendering/RenderButton.cpp
===================================================================
--- Source/WebCore/rendering/RenderButton.cpp	(revision 134271)
+++ Source/WebCore/rendering/RenderButton.cpp	(working copy)
@@ -60,7 +60,11 @@
 
 void RenderButton::removeChild(RenderObject* oldChild)
 {
-    if (oldChild == m_inner || !m_inner) {
+    // m_inner should be the only child, but checking for direct children who
+    // are not m_inner prevents security problems when that assumption is
+    // violated.
+    if (oldChild == m_inner || !m_inner || oldChild->parent() == this) {
+        ASSERT(oldChild == m_inner || !m_inner);
         RenderDeprecatedFlexibleBox::removeChild(oldChild);
         m_inner = 0;
     } else