Move WidgetHierarchyUpdatesSuspensionScope into removeChildren loop

Source/WebCore/dom/ContainerNode.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 549 matching lines @@
 
     // Exclude this node when looking for the focused or full screen Node since
     // only children will be removed.
     // FIXME: We should call these inside the loop below. Right now you can focus
     // a node with mutation events and it'll never get blured.
     document()->removeFocusedNodeOfSubtree(this, true);
     document()->removeFullScreenElementOfSubtree(this, true);
 
     ChildListMutationScope mutation(this);
     NodeVector removedChildren;
-    {
+    while (RefPtr<Node> child = m_firstChild) {
+        // Dispatch synchronous events like mutation and unload events.
+        dispatchChildRemovalEvents(child.get());
+        ChildFrameDisconnector(child.get()).disconnect();
+
+        // FIXME: In theory this can fire focus events when the selection
+        // changes, but there's no obvious way to test it.
+        document()->nodeWillBeRemoved(child.get());
+
+        // If an event moved the child start over.
+        if (child != m_firstChild)
+            continue;
+
+        // The widget tree must be updated between each removal so script
+        // cannot run before the tree is in a consistent state.
         WidgetHierarchyUpdatesSuspensionScope suspendWidgetHierarchyUpdates;
+        mutation.willRemoveChild(child.get());
+        child->notifyMutationObserversNodeWillDetach();
+        removeBetween(0, child->nextSibling(), child.get());
+        removedChildren.append(child.release());
+    }
 
-        while (RefPtr<Node> child = m_firstChild) {
-            // Dispatch synchronous events like mutation and unload events.
-            dispatchChildRemovalEvents(child.get());
-            ChildFrameDisconnector(child.get()).disconnect();
-
-            // FIXME: In theory this can fire focus events when the selection
-            // changes, but there's no obvious way to test it.
-            document()->nodeWillBeRemoved(child.get());
-
-            // If an event moved the child start over.
-            if (child != m_firstChild)
-                continue;
-
-            mutation.willRemoveChild(child.get());
-            child->notifyMutationObserversNodeWillDetach();
-            removeBetween(0, child->nextSibling(), child.get());
-            removedChildren.append(child.release());
-        }
-
-        // FIXME: We could avoid walking all the children twice by calling
-        // notify inside the loop and childrenChanged after but that would mean
-        // calling childrenChanged in a different order than all other methods.
-        // Figure out if this is safe.
-        childrenChanged(false, 0, 0, -static_cast<int>(removedChildren.size()));
-        for (size_t i = 0; i < removedChildren.size(); ++i)
-            ChildNodeRemovalNotifier(this).notify(removedChildren[i].get());
-    }
+    // FIXME: We could avoid walking all the children twice by calling
+    // notify inside the loop and childrenChanged after but that would mean
+    // calling childrenChanged in a different order than all other methods.
+    // Figure out if this is safe.
+    childrenChanged(false, 0, 0, -static_cast<int>(removedChildren.size()));
+    for (size_t i = 0; i < removedChildren.size(); ++i)
+        ChildNodeRemovalNotifier(this).notify(removedChildren[i].get());
 
     dispatchSubtreeModifiedEvent();
 }
 
 bool ContainerNode::appendChild(PassRefPtr<Node> newChild, ExceptionCode& ec, AttachBehavior attachBehavior)
 {
     RefPtr<ContainerNode> protect(this);
 
     // Check that this node is not "floating".
     // If it is, it can be deleted as a side effect of sending mutation events.
@@ skipping 328 matching lines @@
         return true;
 
     if (node->isElementNode() && toElement(node)->shadow())
         return true;
 
     return false;
 }
 #endif
 
 } // namespace WebCore