parent->addChild() can delete parent and any of its siblings

third_party/WebKit/Source/core/layout/LayoutListItem.cpp

 /**
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Andrew Wellington (proton@wiretapped.net)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 295 matching lines @@
         // are the only item in that anonymous box (since no line box parent was
         // found). It's ok to just leave the marker where it is in this case.
         if (markerParent && markerParent->isAnonymousBlock())
             lineBoxParent = markerParent;
         else
             lineBoxParent = this;
     }
 
     if (markerParent != lineBoxParent) {
         m_marker->remove();
-        // If markerParent is now an anonymous block with no children, this is the time to attempt to remove it
-        // as it might have gone away after addChild().
-        if (markerParent && markerParent->isAnonymousBlock() && !toLayoutBlock(markerParent)->firstChild() && !toLayoutBlock(markerParent)->continuation())
-            markerParent->destroy();
         lineBoxParent->addChild(m_marker, firstNonMarkerChild(lineBoxParent));
+        // TODO(rhogan): lineBoxParent and markerParent may be deleted by addChild, so they are not safe to reference here.
+        // Once we have a safe way of referencing them delete markerParent if it is an empty anonymous block.
         m_marker->updateMarginsAndContent();
         return true;
     }
 
     return false;
 }
 
 void LayoutListItem::addOverflowFromChildren()
 {
     LayoutBlockFlow::addOverflowFromChildren();
@@ skipping 180 matching lines @@
             // assume that all the following ones have too.
             // This gives us the opportunity to stop here and avoid
             // marking the same nodes again.
             break;
         }
         item->updateValue();
     }
 }
 
 } // namespace blink