Heap-use-after-free in WebCore::RenderObject::childAt

Bug: 11676314

This is a cherry pick of https://codereview.chromium.org/30663003.
Note that it is a cherry-pick of the code only (not the layout
tests). The cherry pick had one minor modification from a reference
to a pointer type.

Change-Id: I4aa902aaa04970eba548ad2eac6d2a288f60bc49
diff --git a/Source/core/dom/ContainerNode.cpp b/Source/core/dom/ContainerNode.cpp
index 8b33eca..5d409c5 100644
--- a/Source/core/dom/ContainerNode.cpp
+++ b/Source/core/dom/ContainerNode.cpp
@@ -431,8 +431,6 @@
     NodeVector children;
     getChildNodes(container, children);
 
-    container->document()->nodeChildrenWillBeRemoved(container);
-
     ChildListMutationScope mutation(container);
     for (NodeVector::const_iterator it = children.begin(); it != children.end(); it++) {
         Node* child = it->get();
@@ -575,6 +573,8 @@
         document()->removeFocusedElementOfSubtree(this, true);
     }
 
+    document()->nodeChildrenWillBeRemoved(this);
+
     NodeVector removedChildren;
     {
         WidgetHierarchyUpdatesSuspensionScope suspendWidgetHierarchyUpdates;