Don't attempt to collapse empty anonymous blocks if they might already have been destroyed

third_party/WebKit/Source/core/layout/LayoutListItem.cpp

Index: third_party/WebKit/Source/core/layout/LayoutListItem.cpp
diff --git a/third_party/WebKit/Source/core/layout/LayoutListItem.cpp b/third_party/WebKit/Source/core/layout/LayoutListItem.cpp
index 0905478e71eb3e1aee3bff94043203efd3b8ef9c..a8fd523ce9972eb6797ca57051238142abefd877 100644
--- a/third_party/WebKit/Source/core/layout/LayoutListItem.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutListItem.cpp
@@ -313,11 +313,12 @@ bool LayoutListItem::updateMarkerLocation()
 
     if (markerParent != lineBoxParent) {
         m_marker->remove();
-        lineBoxParent->addChild(m_marker, firstNonMarkerChild(lineBoxParent));
-        m_marker->updateMarginsAndContent();
-        // If markerParent is an anonymous block with no children, destroy it.
+        // If markerParent is now an anonymous block with no children, this is the time to attemp to remove it

[mstensho (USE GERRIT), 2016/04/04 09:34:52]

"attempt"

+        // as it might have gone away after addChild().
         if (markerParent && markerParent->isAnonymousBlock() && !toLayoutBlock(markerParent)->firstChild() && !toLayoutBlock(markerParent)->continuation())
             markerParent->destroy();
+        lineBoxParent->addChild(m_marker, firstNonMarkerChild(lineBoxParent));
+        m_marker->updateMarginsAndContent();
         return true;
     }