Missing sibling invalidation across removed element.

third_party/WebKit/Source/core/dom/StyleEngine.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  *           (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2011, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2008, 2009, 2011, 2012 Google Inc. All rights reserved.
  * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) Research In Motion Limited 2010-2011. All rights reserved.
@@ skipping 721 matching lines @@
 void StyleEngine::scheduleInvalidationsForRemovedSibling(Element* beforeElement, Element& removedElement, Element& afterElement)
 {
     unsigned affectedSiblings = afterElement.parentNode()->childrenAffectedByIndirectAdjacentRules() ? UINT_MAX : m_maxDirectAdjacentSelectors;
 
     ContainerNode* schedulingParent = afterElement.parentElementOrShadowRoot();
     if (!schedulingParent)
         return;
 
     scheduleSiblingInvalidationsForElement(removedElement, *schedulingParent, 1);
 
-    for (unsigned i = 2; beforeElement && i <= affectedSiblings; i++, beforeElement = ElementTraversal::previousSibling(*beforeElement))
+    for (unsigned i = 1; beforeElement && i <= affectedSiblings; i++, beforeElement = ElementTraversal::previousSibling(*beforeElement))
         scheduleSiblingInvalidationsForElement(*beforeElement, *schedulingParent, i);
 }
 
 void StyleEngine::scheduleNthPseudoInvalidations(ContainerNode& nthParent)
 {
     InvalidationLists invalidationLists;
     ensureResolver().ensureUpdatedRuleFeatureSet().collectNthInvalidationSet(invalidationLists);
     m_styleInvalidator.scheduleInvalidationSetsForNode(invalidationLists, nthParent);
 }
 
@@ skipping 156 matching lines @@
 
 DEFINE_TRACE_WRAPPERS(StyleEngine)
 {
     for (auto sheet : m_injectedAuthorStyleSheets) {
         visitor->traceWrappers(sheet);
     }
     visitor->traceWrappers(m_documentStyleSheetCollection);
 }
 
 } // namespace blink