Merge 86358 - 2011-05-12 Carol Szabo <carol@webkit.org>

Source/WebCore/dom/ContainerNode.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 516 matching lines @@
         // Remove the node from the tree before calling detach or removedFromDocument (4427024, 4129744).
         // removeChild() does this after calling detach(). There is no explanation for
         // this discrepancy between removeChild() and its optimized version removeChildren().
         n->setPreviousSibling(0);
         n->setNextSibling(0);
         n->setParent(0);
 
         m_firstChild = next;
         if (n == m_lastChild)
             m_lastChild = 0;
-
-        if (n->attached())
-            n->detach();
-
         removedChildren.append(n.release());
     }
-    allowEventDispatch();
 
     size_t removedChildrenCount = removedChildren.size();
+    size_t i;
+
+    // Detach the nodes only after properly removed from the tree because
+    // a. detaching requires a proper DOM tree (for counters and quotes for
+    // example) and during the previous loop the next sibling still points to
+    // the node being removed while the node being removed does not point back
+    // and does not point to the same parent as its next sibling.
+    // b. destroying Renderers of standalone nodes is sometimes faster.
+    for (i = 0; i < removedChildrenCount; ++i) {
+        Node* removedChild = removedChildren[i].get();
+        if (removedChild->attached())
+            removedChild->detach();
+    }
+
+    allowEventDispatch();
 
     // Dispatch a single post-removal mutation event denoting a modified subtree.
     childrenChanged(false, 0, 0, -static_cast<int>(removedChildrenCount));
     dispatchSubtreeModifiedEvent();
 
-    for (size_t i = 0; i < removedChildrenCount; ++i) {
+    for (i = 0; i < removedChildrenCount; ++i) {
         Node* removedChild = removedChildren[i].get();
         if (removedChild->inDocument())
             removedChild->removedFromDocument();
         // removeChild() calls removedFromTree(true) if the child was not in the
         // document. There is no explanation for this discrepancy between removeChild()
         // and its optimized version removeChildren().
     }
 }
 
 bool ContainerNode::appendChild(PassRefPtr<Node> newChild, ExceptionCode& ec, bool shouldLazyAttach)
@@ skipping 530 matching lines @@
     if (!document()->hasListenerType(Document::BEFORELOAD_LISTENER))
         return true;
 
     RefPtr<ContainerNode> protector(this);
     RefPtr<BeforeLoadEvent> beforeLoadEvent = BeforeLoadEvent::create(sourceURL);
     dispatchEvent(beforeLoadEvent.get());
     return !beforeLoadEvent->defaultPrevented();
 }
 
 } // namespace WebCore