Missing m_registeredAsCandidate = false.

Missing m_registeredAsCandidate = false.

Added a missing reset of registeredAsCandidate when calling
removeStyleSheetCandidateNode() from clearDocumentData().

BUG=468267
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=194799

[rune, 2015-04-24 16:03:04]

rune@opera.com changed reviewers:
+ dglazkov@chromium.org

[rune, 2015-04-24 16:03:05]

Adding asserts to try to smoke out the reason for the crasher.

[rune, 2015-04-28 09:44:27]

rune@opera.com changed reviewers:
+ tasak@google.com

[rune, 2015-04-28 09:44:27]

PTAL

[tasak, 2015-04-28 10:19:05]

https://codereview.chromium.org/1102003002/diff/1/Source/core/dom/StyleElemen...
File Source/core/dom/StyleElement.cpp (right):

https://codereview.chromium.org/1102003002/diff/1/Source/core/dom/StyleElemen...
Source/core/dom/StyleElement.cpp:59: ASSERT(!m_registeredAsCandidate);
I heard that inserted elements might be destroyed without invoking removedFrom.
So I'm not sure but this ASSERT() might cause some crash reports.

[rune, 2015-04-28 10:38:51]

On 2015/04/28 10:19:05, tasak wrote:
>
https://codereview.chromium.org/1102003002/diff/1/Source/core/dom/StyleElemen...
> File Source/core/dom/StyleElement.cpp (right):
> 
>
https://codereview.chromium.org/1102003002/diff/1/Source/core/dom/StyleElemen...
> Source/core/dom/StyleElement.cpp:59: ASSERT(!m_registeredAsCandidate);
> I heard that inserted elements might be destroyed without invoking
removedFrom.
> So I'm not sure but this ASSERT() might cause some crash reports.

That's what I'm trying to trigger. I couldn't find out how through code
inspection, so I was hoping that we catch the crasher this way. If you know how
we can end up destroying an element which has m_registeredAsCandidate=true,
please tell.

[rune, 2015-04-29 16:09:56]

On 2015/04/28 10:38:51, rune wrote:
> On 2015/04/28 10:19:05, tasak wrote:
> >
>
https://codereview.chromium.org/1102003002/diff/1/Source/core/dom/StyleElemen...
> > File Source/core/dom/StyleElement.cpp (right):
> > 
> >
>
https://codereview.chromium.org/1102003002/diff/1/Source/core/dom/StyleElemen...
> > Source/core/dom/StyleElement.cpp:59: ASSERT(!m_registeredAsCandidate);
> > I heard that inserted elements might be destroyed without invoking
> removedFrom.
> > So I'm not sure but this ASSERT() might cause some crash reports.
> 
> That's what I'm trying to trigger. I couldn't find out how through code
> inspection, so I was hoping that we catch the crasher this way. If you know
how
> we can end up destroying an element which has m_registeredAsCandidate=true,
> please tell.

I've removed the asserts now, but kept the missing reset of the flag.

[tasak, 2015-05-01 07:48:06]

lgtm

[rune, 2015-05-01 08:30:19]

The CQ bit was checked by rune@opera.com

[commit-bot: I haz the power, 2015-05-01 08:30:31]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1102003002/20001

[commit-bot: I haz the power, 2015-05-01 10:30:13]

Committed patchset #2 (id:20001) as
https://src.chromium.org/viewvc/blink?view=rev&revision=194799