| Index: Source/core/rendering/RenderBlock.cpp
|
| diff --git a/Source/core/rendering/RenderBlock.cpp b/Source/core/rendering/RenderBlock.cpp
|
| index ba3c7322890ae677a7282cb4337d8cef2ff941db..77d15f5d119846cd8572578c0b4a09128324eb7d 100644
|
| --- a/Source/core/rendering/RenderBlock.cpp
|
| +++ b/Source/core/rendering/RenderBlock.cpp
|
| @@ -277,6 +277,11 @@ void RenderBlock::willBeDestroyed()
|
| // Mark as being destroyed to avoid trouble with merges in removeChild().
|
| m_beingDestroyed = true;
|
|
|
| + if (!documentBeingDestroyed()) {
|
| + if (firstChild() && firstChild()->isRunIn())
|
| + moveRunInToOriginalPosition(firstChild());
|
| + }
|
| +
|
| // Make sure to destroy anonymous children first while they are still connected to the rest of the tree, so that they will
|
| // properly dirty line boxes that they are removed from. Effects that do :before/:after only on hover could crash otherwise.
|
| children()->destroyLeftoverChildren();
|
| @@ -1979,6 +1984,9 @@ void RenderBlock::moveRunInUnderSiblingBlockIfNeeded(RenderObject* runIn)
|
| if (!curr || !curr->isRenderBlock() || !curr->childrenInline())
|
| return;
|
|
|
| + if (toRenderBlock(curr)->beingDestroyed())
|
| + return;
|
| +
|
| // Per CSS3, "A run-in cannot run in to a block that already starts with a
|
| // run-in or that itself is a run-in".
|
| if (curr->isRunIn() || (curr->firstChild() && curr->firstChild()->isRunIn()))
|
|
|