Merge 76859

Source/WebCore/rendering/RenderWidget.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2000 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2006, 2009, 2010 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
@@ skipping 102 matching lines @@
     // want to unconditionally delete ourselves (we're ref-counted).
     // So the code below includes copied and pasted contents of
     // both RenderBox::destroy() and RenderObject::destroy().
     // Fix originally made for <rdar://problem/4228818>.
 
     animation()->cancelAnimations(this);
 
     if (RenderView* v = view())
         v->removeWidget(this);
 
-    if (m_hasCounterNodeMap)
-        RenderCounter::destroyCounterNodes(this);
     
     if (AXObjectCache::accessibilityEnabled()) {
         document()->axObjectCache()->childrenChanged(this->parent());
         document()->axObjectCache()->remove(this);
     }
     remove();
 
+    if (m_hasCounterNodeMap)
+        RenderCounter::destroyCounterNodes(this);
+
     setWidget(0);
 
     // removes from override size map
     if (hasOverrideSize())
         setOverrideSize(-1);
 
     if (style() && (style()->height().isPercent() || style()->minHeight().isPercent() || style()->maxHeight().isPercent()))
         RenderBlock::removePercentHeightDescendant(this);
 
     if (hasLayer()) {
@@ skipping 250 matching lines @@
     bool hadResult = result.innerNode();
     bool inside = RenderReplaced::nodeAtPoint(request, result, x, y, tx, ty, action);
     
     // Check to see if we are really over the widget itself (and not just in the border/padding area).
     if ((inside || result.isRectBasedTest()) && !hadResult && result.innerNode() == node())
         result.setIsOverWidget(contentBoxRect().contains(result.localPoint()));
     return inside;
 }
 
 } // namespace WebCore