Notify the counter code about layout object removals BEFORE removing.

Source/core/layout/LayoutObjectChildList.cpp

Index: Source/core/layout/LayoutObjectChildList.cpp
diff --git a/Source/core/layout/LayoutObjectChildList.cpp b/Source/core/layout/LayoutObjectChildList.cpp
index 5e6c2ea0385a15aab077e3793f10d61afd2e40cd..c36ea8dd83d0b1c1607479f0efb9c5ebd9c4e15a 100644
--- a/Source/core/layout/LayoutObjectChildList.cpp
+++ b/Source/core/layout/LayoutObjectChildList.cpp
@@ -84,8 +84,10 @@ LayoutObject* LayoutObjectChildList::removeChildNode(LayoutObject* owner, Layout
     if (!owner->documentBeingDestroyed())
         owner->notifyOfSubtreeChange();
 
-    if (!owner->documentBeingDestroyed() && notifyLayoutObject)
+    if (!owner->documentBeingDestroyed() && notifyLayoutObject) {
+        LayoutCounter::layoutObjectSubtreeWillBeDetached(oldChild);
         oldChild->willBeRemovedFromTree();
+    }
 
     // WARNING: There should be no code running between willBeRemovedFromTree and the actual removal below.
     // This is needed to avoid race conditions where willBeRemovedFromTree would dirty the tree's structure
@@ -107,11 +109,6 @@ LayoutObject* LayoutObjectChildList::removeChildNode(LayoutObject* owner, Layout
 
     oldChild->registerSubtreeChangeListenerOnDescendants(oldChild->consumesSubtreeChangeNotification());
 
-    // layoutObjectRemovedFromTree walks the whole subtree. We can improve performance
-    // by skipping this step when destroying the entire tree.
-    if (!owner->documentBeingDestroyed())
-        LayoutCounter::layoutObjectRemovedFromTree(oldChild);
-
     if (AXObjectCache* cache = owner->document().existingAXObjectCache())
         cache->childrenChanged(owner);
 
@@ -154,10 +151,8 @@ void LayoutObjectChildList::insertChildNode(LayoutObject* owner, LayoutObject* n
         setLastChild(newChild);
     }
 
-    if (!owner->documentBeingDestroyed() && notifyLayoutObject)
+    if (!owner->documentBeingDestroyed() && notifyLayoutObject) {
         newChild->insertedIntoTree();
-
-    if (!owner->documentBeingDestroyed()) {
         LayoutCounter::layoutObjectSubtreeAttached(newChild);
     }