Missing m_registeredAsCandidate = false.

Source/core/dom/StyleElement.cpp

Index: Source/core/dom/StyleElement.cpp
diff --git a/Source/core/dom/StyleElement.cpp b/Source/core/dom/StyleElement.cpp
index 79a03030c3e3a6117df0c6c449e4dcfb44dc4e3b..c86d84dfa09faff040cd50b9aee94369986204af 100644
--- a/Source/core/dom/StyleElement.cpp
+++ b/Source/core/dom/StyleElement.cpp
@@ -56,6 +56,7 @@ StyleElement::StyleElement(Document* document, bool createdByParser)
 
 StyleElement::~StyleElement()
 {
+    ASSERT(!m_registeredAsCandidate);

[tasak, 2015/04/28 10:19:05]

I heard that inserted elements might be destroyed without invoking removedFrom.
So I'm not sure but this ASSERT() might cause some crash reports.

 #if !ENABLE(OILPAN)
     if (m_sheet)
         clearSheet();
@@ -86,8 +87,10 @@ void StyleElement::insertedInto(Element* element, ContainerNode* insertionPoint)
 
 void StyleElement::removedFrom(Element* element, ContainerNode* insertionPoint)
 {
-    if (!insertionPoint->inDocument())
+    if (!insertionPoint->inDocument()) {
+        ASSERT(!m_registeredAsCandidate);
         return;
+    }
 
     ShadowRoot* shadowRoot = element->containingShadowRoot();
     if (!shadowRoot)
@@ -118,6 +121,7 @@ void StyleElement::clearDocumentData(Document& document, Element* element)
     if (m_registeredAsCandidate) {
         ASSERT(element->inDocument());
         document.styleEngine().removeStyleSheetCandidateNode(element, element->treeScope());
+        m_registeredAsCandidate = false;
     }
 }