Merge 108152

Source/WebCore/dom/ContainerNode.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 461 matching lines @@
 
     // FIXME: After sending the mutation events, "this" could be destroyed.
     // We can prevent that by doing a "ref", but first we have to make sure
     // that no callers call with ref count == 0 and parent = 0 (as of this
     // writing, there are definitely callers who call that way).
 
     Node* prev = child->previousSibling();
     Node* next = child->nextSibling();
     removeBetween(prev, next, child.get());
 
-    // Dispatch post-removal mutation events
-    childrenChanged(false, prev, next, -1);
-    dispatchSubtreeModifiedEvent();
-
     if (child->inDocument())
         child->removedFromDocument();
     else
         child->removedFromTree(true);
 
+    // Dispatch post-removal mutation events
+    childrenChanged(false, prev, next, -1);
+    dispatchSubtreeModifiedEvent();
+
     return child;
 }
 
 void ContainerNode::removeBetween(Node* previousChild, Node* nextChild, Node* oldChild)
 {
     ASSERT(oldChild);
     ASSERT(oldChild->parentNode() == this);
 
     forbidEventDispatch();
 
@@ skipping 672 matching lines @@
     if (!document()->hasListenerType(Document::BEFORELOAD_LISTENER))
         return true;
 
     RefPtr<ContainerNode> protector(this);
     RefPtr<BeforeLoadEvent> beforeLoadEvent = BeforeLoadEvent::create(sourceURL);
     dispatchEvent(beforeLoadEvent.get());
     return !beforeLoadEvent->defaultPrevented();
 }
 
 } // namespace WebCore