Index: Source/core/rendering/RenderBlock.cpp |
diff --git a/Source/core/rendering/RenderBlock.cpp b/Source/core/rendering/RenderBlock.cpp |
index ba3c7322890ae677a7282cb4337d8cef2ff941db..77d15f5d119846cd8572578c0b4a09128324eb7d 100644 |
--- a/Source/core/rendering/RenderBlock.cpp |
+++ b/Source/core/rendering/RenderBlock.cpp |
@@ -277,6 +277,11 @@ void RenderBlock::willBeDestroyed() |
// Mark as being destroyed to avoid trouble with merges in removeChild(). |
m_beingDestroyed = true; |
+ if (!documentBeingDestroyed()) { |
+ if (firstChild() && firstChild()->isRunIn()) |
+ moveRunInToOriginalPosition(firstChild()); |
+ } |
+ |
// Make sure to destroy anonymous children first while they are still connected to the rest of the tree, so that they will |
// properly dirty line boxes that they are removed from. Effects that do :before/:after only on hover could crash otherwise. |
children()->destroyLeftoverChildren(); |
@@ -1979,6 +1984,9 @@ void RenderBlock::moveRunInUnderSiblingBlockIfNeeded(RenderObject* runIn) |
if (!curr || !curr->isRenderBlock() || !curr->childrenInline()) |
return; |
+ if (toRenderBlock(curr)->beingDestroyed()) |
+ return; |
+ |
// Per CSS3, "A run-in cannot run in to a block that already starts with a |
// run-in or that itself is a run-in". |
if (curr->isRunIn() || (curr->firstChild() && curr->firstChild()->isRunIn())) |