| Index: Source/core/rendering/RenderObject.cpp
|
| diff --git a/Source/core/rendering/RenderObject.cpp b/Source/core/rendering/RenderObject.cpp
|
| index 4728932f4336a8a2e5db0e9762673725d363d0dc..b60b8b74d0eded228f5382d0ce17b35afb6e866f 100644
|
| --- a/Source/core/rendering/RenderObject.cpp
|
| +++ b/Source/core/rendering/RenderObject.cpp
|
| @@ -2705,22 +2705,6 @@ bool RenderObject::isSelectionBorder() const
|
| return st == SelectionStart || st == SelectionEnd || st == SelectionBoth;
|
| }
|
|
|
| -inline void RenderObject::clearLayoutRootIfNeeded() const
|
| -{
|
| - if (frame()) {
|
| - if (FrameView* view = frame()->view()) {
|
| - if (view->layoutRoot() == this) {
|
| - if (!documentBeingDestroyed())
|
| - ASSERT_NOT_REACHED();
|
| - // This indicates a failure to layout the child, which is why
|
| - // the layout root is still set to |this|. Make sure to clear it
|
| - // since we are getting destroyed.
|
| - view->clearLayoutSubtreeRoot();
|
| - }
|
| - }
|
| - }
|
| -}
|
| -
|
| void RenderObject::willBeDestroyed()
|
| {
|
| // Destroy any leftover anonymous children.
|
| @@ -2728,10 +2712,14 @@ void RenderObject::willBeDestroyed()
|
| if (children)
|
| children->destroyLeftoverChildren();
|
|
|
| - // If this renderer is being autoscrolled, stop the autoscrolling.
|
| if (LocalFrame* frame = this->frame()) {
|
| + // If this renderer is being autoscrolled, stop the autoscrolling.
|
| if (frame->page())
|
| frame->page()->autoscrollController().stopAutoscrollIfNeeded(this);
|
| +
|
| + // Make sure the FrameView doesn't hang onto stale pointers.
|
| + if (FrameView* view = frame->view())
|
| + view->rendererWillBeDestroyed(this);
|
| }
|
|
|
| // For accessibility management, notify the parent of the imminent change to its child set.
|
| @@ -2762,8 +2750,6 @@ void RenderObject::willBeDestroyed()
|
| document().didRemoveTouchEventHandler(node());
|
|
|
| setAncestorLineBoxDirty(false);
|
| -
|
| - clearLayoutRootIfNeeded();
|
| }
|
|
|
| void RenderObject::insertedIntoTree()
|
|
|