Notify the counter code about layout object removals BEFORE removing.

Source/core/layout/LayoutObjectChildList.cpp

 /*
  * Copyright (C) 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) Research In Motion Limited 2010. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 66 matching lines @@
     // If oldChild is the start or end of the selection, then clear the selection to
     // avoid problems of invalid pointers.
     // FIXME: The FrameSelection should be responsible for this when it
     // is notified of DOM mutations.
     if (!owner->documentBeingDestroyed() && oldChild->isSelectionBorder())
         owner->view()->clearSelection();
 
     if (!owner->documentBeingDestroyed())
         owner->notifyOfSubtreeChange();
 
-    if (!owner->documentBeingDestroyed() && notifyLayoutObject)
+    if (!owner->documentBeingDestroyed() && notifyLayoutObject) {
+        LayoutCounter::layoutObjectSubtreeWillBeDetached(oldChild);
         oldChild->willBeRemovedFromTree();
+    }
 
     // WARNING: There should be no code running between willBeRemovedFromTree and the actual removal below.
     // This is needed to avoid race conditions where willBeRemovedFromTree would dirty the tree's structure
     // and the code running here would force an untimely rebuilding, leaving |oldChild| dangling.
 
     if (oldChild->previousSibling())
         oldChild->previousSibling()->setNextSibling(oldChild->nextSibling());
     if (oldChild->nextSibling())
         oldChild->nextSibling()->setPreviousSibling(oldChild->previousSibling());
 
     if (firstChild() == oldChild)
         setFirstChild(oldChild->nextSibling());
     if (lastChild() == oldChild)
         setLastChild(oldChild->previousSibling());
 
     oldChild->setPreviousSibling(0);
     oldChild->setNextSibling(0);
     oldChild->setParent(0);
 
     oldChild->registerSubtreeChangeListenerOnDescendants(oldChild->consumesSubtreeChangeNotification());
 
-    // layoutObjectRemovedFromTree walks the whole subtree. We can improve performance
-    // by skipping this step when destroying the entire tree.
-    if (!owner->documentBeingDestroyed())
-        LayoutCounter::layoutObjectRemovedFromTree(oldChild);
-
     if (AXObjectCache* cache = owner->document().existingAXObjectCache())
         cache->childrenChanged(owner);
 
     return oldChild;
 }
 
 void LayoutObjectChildList::insertChildNode(LayoutObject* owner, LayoutObject* newChild, LayoutObject* beforeChild, bool notifyLayoutObject)
 {
     ASSERT(!newChild->parent());
     ASSERT(this == owner->virtualChildren());
@@ skipping 22 matching lines @@
         newChild->setPreviousSibling(previousSibling);
         newChild->setNextSibling(beforeChild);
         beforeChild->setPreviousSibling(newChild);
     } else {
         if (lastChild())
             lastChild()->setNextSibling(newChild);
         newChild->setPreviousSibling(lastChild());
         setLastChild(newChild);
     }
 
-    if (!owner->documentBeingDestroyed() && notifyLayoutObject)
+    if (!owner->documentBeingDestroyed() && notifyLayoutObject) {
         newChild->insertedIntoTree();
-
-    if (!owner->documentBeingDestroyed()) {
         LayoutCounter::layoutObjectSubtreeAttached(newChild);
     }
 
     // Propagate the need to notify ancestors down into any
     // child nodes.
     if (owner->hasSubtreeChangeListenerRegistered())
         newChild->registerSubtreeChangeListenerOnDescendants(true);
 
     // If the inserted node is currently marked as needing to notify children then
     // we have to propagate that mark up the tree.
@@ skipping 24 matching lines @@
     DisableCompositingQueryAsserts disabler;
     // FIXME: We should not allow paint invalidation out of paint invalidation state. crbug.com/457415
     DisablePaintInvalidationStateAsserts paintInvalidationAssertDisabler;
     const LayoutBoxModelObject* paintInvalidationContainer = oldChild.containerForPaintInvalidation();
     oldChild.invalidatePaintUsingContainer(paintInvalidationContainer, oldChild.previousPaintInvalidationRect(), PaintInvalidationLayoutObjectRemoval);
     if (RuntimeEnabledFeatures::slimmingPaintEnabled())
         oldChild.invalidateDisplayItemClients(*paintInvalidationContainer);
 }
 
 } // namespace blink