Avoid N^2 walk placing renderers when building the render tree

Source/core/dom/ContainerNodeAlgorithms.cpp

Index: Source/core/dom/ContainerNodeAlgorithms.cpp
diff --git a/Source/core/dom/ContainerNodeAlgorithms.cpp b/Source/core/dom/ContainerNodeAlgorithms.cpp
index 59d65ed55340ad3ec3cde2bd642bd37d7b21bdf0..e06aedc241e519eb574becdc859cb98fd5ffe49a 100644
--- a/Source/core/dom/ContainerNodeAlgorithms.cpp
+++ b/Source/core/dom/ContainerNodeAlgorithms.cpp
@@ -35,7 +35,7 @@ namespace WebCore {
 void ChildNodeInsertionNotifier::notifyDescendantInsertedIntoDocument(ContainerNode* node)
 {
     ChildNodesLazySnapshot snapshot(node);
-    while (RefPtr<Node> child = snapshot.nextNode()) {
+    while (RefPtr<Node> child = snapshot.previousNode()) {
         // If we have been removed from the document during this loop, then
         // we don't want to tell the rest of our children that they've been
         // inserted into the document because they haven't.
@@ -69,7 +69,7 @@ void ChildNodeInsertionNotifier::notifyDescendantInsertedIntoTree(ContainerNode*
 void ChildNodeRemovalNotifier::notifyDescendantRemovedFromDocument(ContainerNode* node)
 {
     ChildNodesLazySnapshot snapshot(node);
-    while (RefPtr<Node> child = snapshot.nextNode()) {
+    while (RefPtr<Node> child = snapshot.previousNode()) {
         // If we have been added to the document during this loop, then we
         // don't want to tell the rest of our children that they've been
         // removed from the document because they haven't.