parent->addChild() can delete parent and any of its siblings

third_party/WebKit/Source/core/layout/LayoutListItem.cpp

Index: third_party/WebKit/Source/core/layout/LayoutListItem.cpp
diff --git a/third_party/WebKit/Source/core/layout/LayoutListItem.cpp b/third_party/WebKit/Source/core/layout/LayoutListItem.cpp
index 6724ab10d058fba3e41a378bdae5c630255ff8ad..68e9df7691a728257a35cb63f73d1b0e33067038 100644
--- a/third_party/WebKit/Source/core/layout/LayoutListItem.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutListItem.cpp
@@ -313,11 +313,9 @@ bool LayoutListItem::updateMarkerLocation()
 
     if (markerParent != lineBoxParent) {
         m_marker->remove();
-        // If markerParent is now an anonymous block with no children, this is the time to attempt to remove it
-        // as it might have gone away after addChild().
-        if (markerParent && markerParent->isAnonymousBlock() && !toLayoutBlock(markerParent)->firstChild() && !toLayoutBlock(markerParent)->continuation())
-            markerParent->destroy();
         lineBoxParent->addChild(m_marker, firstNonMarkerChild(lineBoxParent));
+        // TODO(rhogan): lineBoxParent and markerParent may be deleted by addChild, so they are not safe to reference here.
+        // Once we have a safe way of referencing them delete markerParent if it is an empty anonymous block.
         m_marker->updateMarginsAndContent();
         return true;
     }