Detach first letter pseudo element during RenderTextFragment destruction.

If the RenderTextFragment is being destroyed, make sure the pseudo element
is unlinked (Oilpan or not) during destroy() instead.

R=haraken
BUG=391288

Review URL: https://codereview.chromium.org/660413002

git-svn-id: svn://svn.chromium.org/blink/trunk@183943 bbb929c8-8fbe-4397-9dbb-9b2b20218538

third_party/WebKit/Source/core/rendering/RenderTextFragment.cpp

@@ -53,11 +53,15 @@ RenderTextFragment::RenderTextFragment(Node* node, StringImpl* str)
 
 RenderTextFragment::~RenderTextFragment()
 {
-#if !ENABLE(OILPAN)
+    ASSERT(!m_firstLetterPseudoElement);
+}
+
+void RenderTextFragment::destroy()
+{
     if (m_isRemainingTextRenderer && m_firstLetterPseudoElement)
         m_firstLetterPseudoElement->setRemainingTextRenderer(nullptr);
     m_firstLetterPseudoElement = nullptr;
-#endif
+    RenderText::destroy();
 }
 
 void RenderTextFragment::trace(Visitor* visitor)

third_party/WebKit/Source/core/rendering/RenderTextFragment.h

@@ -39,6 +39,7 @@ public:
     RenderTextFragment(Node*, StringImpl*);
     virtual ~RenderTextFragment();
     virtual void trace(Visitor*) override;
+    virtual void destroy() override;
 
     virtual bool isTextFragment() const override { return true; }