A RenderListMarker is either in-tree and owned by the tree, or out-of-tree and owned by a RenderListItem. This patch changes RenderListItem::m_marker to be a raw pointer, and removes the special handling of list markers in RenderElement child teardown. We also remove the willBeDestroyed() hook. It was used to clear out the m_marker pointer, but this is now done in the regular ~RenderListItem() destructor with an assertion for marker sanity. m_marker is automatically nulled out by a didDestroyListMarker() callback on RenderListItem.
Created attachment 240878 [details] Patch
Comment on attachment 240878 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=240878&action=review > Source/WebCore/rendering/RenderListItem.h:89 > - RenderPtr<RenderListMarker> m_marker; > + RenderListMarker* m_marker; Weak pointers would be cool.
Comment on attachment 240878 [details] Patch Clearing flags on attachment: 240878 Committed r175505: <http://trac.webkit.org/changeset/175505>
All reviewed patches have been landed. Closing bug.