Merge 116683

Source/WebCore/rendering/RenderObjectChildList.cpp

 /*
  * Copyright (C) 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) Research In Motion Limited 2010. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 57 matching lines @@
     while (object && object->isAnonymousBlock() && !object->isRenderFlowThread())
         object = object->parent();
 
     return object && object->isRenderFlowThread() ? toRenderFlowThread(object) : 0;
 }
 
 RenderObject* RenderObjectChildList::removeChildNode(RenderObject* owner, RenderObject* oldChild, bool fullRemove)
 {
     ASSERT(oldChild->parent() == owner);
 
+    if (oldChild->isFloatingOrPositioned())
+        toRenderBox(oldChild)->removeFloatingOrPositionedChildFromBlockLists();
+
     // So that we'll get the appropriate dirty bit set (either that a normal flow child got yanked or
     // that a positioned child got yanked).  We also repaint, so that the area exposed when the child
     // disappears gets repainted properly.
     if (!owner->documentBeingDestroyed() && fullRemove && oldChild->everHadLayout()) {
         oldChild->setNeedsLayoutAndPrefWidthsRecalc();
         if (oldChild->isBody())
             owner->view()->repaint();
         else
             oldChild->repaint();
     }
@@ skipping 456 matching lines @@
             }
             if (generatedContentContainer->isChildAllowed(renderer, pseudoElementStyle))
                 generatedContentContainer->addChild(renderer);
             else
                 renderer->destroy();
         }
     }
 }
 
 } // namespace WebCore