CVS commit by pletourn: 

Prevent a crash in replaceChildren(c1,c2) when c1,c2 are near sibling
Prevent a crash in removeChildren() by reiniting _first earlier


  M +6 -2      dom_nodeimpl.cpp   1.244


--- kdelibs/khtml/xml/dom_nodeimpl.cpp  #1.243:1.244
@@ -1074,4 +1074,8 @@ NodeImpl *NodeBaseImpl::replaceChild ( N
         // If child is already present in the tree, first remove it
         NodeImpl *newParent = child->parentNode();
+        if ( child == next )
+            next = child->nextSibling();
+        if ( child == prev )
+            prev = child->previousSibling();
         if(newParent)
             newParent->removeChild( child, exceptioncode );
@@ -1163,5 +1167,5 @@ void NodeBaseImpl::removeChildren()
 {
     NodeImpl *n, *next;
-    for( n = _first; n; n = next )
+    for( n = _first, _first = 0; n; n = next )
     {
         next = n->nextSibling();
@@ -1177,5 +1181,5 @@ void NodeBaseImpl::removeChildren()
                 c->removedFromDocument();
     }
-    _first = _last = 0;
+    _last = 0;
 }