Missing m_registeredAsCandidate = false.

Source/core/dom/StyleElement.cpp

 /*
  * Copyright (C) 2006, 2007 Rob Buis
  * Copyright (C) 2008 Apple, Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
@@ skipping 38 matching lines @@
     , m_loading(false)
     , m_registeredAsCandidate(false)
     , m_startPosition(TextPosition::belowRangePosition())
 {
     if (createdByParser && document && document->scriptableDocumentParser() && !document->isInDocumentWrite())
         m_startPosition = document->scriptableDocumentParser()->textPosition();
 }
 
 StyleElement::~StyleElement()
 {
+    ASSERT(!m_registeredAsCandidate);

[tasak, 2015/04/28 10:19:05]

I heard that inserted elements might be destroyed without invoking removedFrom.
So I'm not sure but this ASSERT() might cause some crash reports.

 #if !ENABLE(OILPAN)
     if (m_sheet)
         clearSheet();
 #endif
 }
 
 StyleElement::ProcessingResult StyleElement::processStyleSheet(Document& document, Element* element)
 {
     TRACE_EVENT0("blink", "StyleElement::processStyleSheet");
     ASSERT(element);
@@ skipping 10 matching lines @@
 void StyleElement::insertedInto(Element* element, ContainerNode* insertionPoint)
 {
     if (!insertionPoint->inDocument() || !element->isInShadowTree())
         return;
     if (ShadowRoot* scope = element->containingShadowRoot())
         scope->registerScopedHTMLStyleChild();
 }
 
 void StyleElement::removedFrom(Element* element, ContainerNode* insertionPoint)
 {
-    if (!insertionPoint->inDocument())
+    if (!insertionPoint->inDocument()) {
+        ASSERT(!m_registeredAsCandidate);
         return;
+    }
 
     ShadowRoot* shadowRoot = element->containingShadowRoot();
     if (!shadowRoot)
         shadowRoot = insertionPoint->containingShadowRoot();
 
     if (shadowRoot)
         shadowRoot->unregisterScopedHTMLStyleChild();
 
     Document& document = element->document();
     if (m_registeredAsCandidate) {
@@ skipping 10 matching lines @@
 }
 
 void StyleElement::clearDocumentData(Document& document, Element* element)
 {
     if (m_sheet)
         m_sheet->clearOwnerNode();
 
     if (m_registeredAsCandidate) {
         ASSERT(element->inDocument());
         document.styleEngine().removeStyleSheetCandidateNode(element, element->treeScope());
+        m_registeredAsCandidate = false;
     }
 }
 
 StyleElement::ProcessingResult StyleElement::childrenChanged(Element* element)
 {
     ASSERT(element);
     if (m_createdByParser)
         return ProcessingSuccessful;
 
     return process(element);
@@ skipping 95 matching lines @@
 {
     document.styleEngine().addPendingSheet();
 }
 
 DEFINE_TRACE(StyleElement)
 {
     visitor->trace(m_sheet);
 }
 
 }