Move runin to original position when sibling element is destroyed. Additionally, if If moveRunInUnd…

Source/core/rendering/RenderBlock.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2007 David Smith (catfish.man@gmail.com)
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) Research In Motion Limited 2010. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 259 matching lines @@
     RenderBlock* renderer = new (document->renderArena()) RenderBlock(0);
     renderer->setDocumentForAnonymous(document);
     return renderer;
 }
 
 void RenderBlock::willBeDestroyed()
 {
     // Mark as being destroyed to avoid trouble with merges in removeChild().
     m_beingDestroyed = true;
 
+    if (!documentBeingDestroyed()) {
+        if (firstChild() && firstChild()->isRunIn())
+            moveRunInToOriginalPosition(firstChild());
+    }
+
     // Make sure to destroy anonymous children first while they are still connected to the rest of the tree, so that they will
     // properly dirty line boxes that they are removed from. Effects that do :before/:after only on hover could crash otherwise.
     children()->destroyLeftoverChildren();
 
     // Destroy our continuation before anything other than anonymous children.
     // The reason we don't destroy it before anonymous children is that they may
     // have continuations of their own that are anonymous children of our continuation.
     RenderBoxModelObject* continuation = this->continuation();
     if (continuation) {
         continuation->destroy();
@@ skipping 1682 matching lines @@
 
     // Check if this node is allowed to run-in. E.g. <select> expects its renderer to
     // be a RenderListBox or RenderMenuList, and hence cannot be a RenderInline run-in.
     if (!runIn->canBeReplacedWithInlineRunIn())
         return;
 
     RenderObject* curr = runIn->nextSibling();
     if (!curr || !curr->isRenderBlock() || !curr->childrenInline())
         return;
 
+    if (toRenderBlock(curr)->beingDestroyed())
+        return;
+
     // Per CSS3, "A run-in cannot run in to a block that already starts with a
     // run-in or that itself is a run-in".
     if (curr->isRunIn() || (curr->firstChild() && curr->firstChild()->isRunIn()))
         return;
 
     if (curr->isAnonymous() || curr->isFloatingOrOutOfFlowPositioned())
         return;
 
     // FIXME: We don't support run-ins with or as part of a continuation
     // as it makes the back-and-forth placing complex.
@@ skipping 6277 matching lines @@
     memoryInstrumentation->addRootObject(gPositionedDescendantsMap, WebCoreMemoryTypes::RenderingStructures);
     memoryInstrumentation->addRootObject(gPercentHeightDescendantsMap, WebCoreMemoryTypes::RenderingStructures);
     memoryInstrumentation->addRootObject(gPositionedContainerMap, WebCoreMemoryTypes::RenderingStructures);
     memoryInstrumentation->addRootObject(gPercentHeightContainerMap, WebCoreMemoryTypes::RenderingStructures);
     memoryInstrumentation->addRootObject(gFloatingObjectContainerMap, WebCoreMemoryTypes::RenderingStructures);
     memoryInstrumentation->addRootObject(gFloatingObjectMap, WebCoreMemoryTypes::RenderingStructures);
     memoryInstrumentation->addRootObject(gDelayedUpdateScrollInfoSet, WebCoreMemoryTypes::RenderingStructures);
 }
 
 } // namespace WebCore