Bug 106384: Heap-use-after-free in WebCore::RenderObject::willBeRemovedFromTree.