Clarify RenderListMarker ownership model.

[Andreas Kling]

A RenderListMarker is either in-tree and owned by the tree, or out-of-tree
and owned by a RenderListItem.

This patch changes RenderListItem::m_marker to be a raw pointer, and removes
the special handling of list markers in RenderElement child teardown.

We also remove the willBeDestroyed() hook. It was used to clear out the
m_marker pointer, but this is now done in the regular ~RenderListItem()
destructor with an assertion for marker sanity. m_marker is automatically
nulled out by a didDestroyListMarker() callback on RenderListItem.

[Andreas Kling]

Created attachment 240878 [details]
Patch

[Antti Koivisto]

Comment on attachment 240878 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=240878&action=review

> Source/WebCore/rendering/RenderListItem.h:89
> -    RenderPtr<RenderListMarker> m_marker;
> +    RenderListMarker* m_marker;

Weak pointers would be cool.

[WebKit Commit Bot]

Comment on attachment 240878 [details]
Patch

Clearing flags on attachment: 240878

Committed r175505: <http://trac.webkit.org/changeset/175505>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.