parserInsertBefore and parserRemoveChild should check newChild for a parent.

Source/core/dom/ContainerNode.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2013 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 67 matching lines @@
 void ContainerNode::removeDetachedChildren()
 {
     ASSERT(!connectedSubframeCount());
     ASSERT(needsAttach());
     removeDetachedChildrenInContainer(*this);
 }
 #endif
 
 void ContainerNode::parserTakeAllChildrenFrom(ContainerNode& oldParent)
 {
-    while (RefPtrWillBeRawPtr<Node> child = oldParent.firstChild()) {
-        oldParent.parserRemoveChild(*child);
-        treeScope().adoptIfNeeded(*child);
+    while (RefPtrWillBeRawPtr<Node> child = oldParent.firstChild())
         parserAppendChild(child.get());
-    }
 }
 
 ContainerNode::~ContainerNode()
 {
     ASSERT(needsAttach());
 #if !ENABLE(OILPAN)
     willBeDeletedFromDocument();
     removeDetachedChildren();
 #endif
 }
@@ skipping 182 matching lines @@
     if (m_lastChild) {
         child.setPreviousSibling(m_lastChild);
         m_lastChild->setNextSibling(&child);
     } else {
         setFirstChild(&child);
     }
 
     setLastChild(&child);
 }
 
 void ContainerNode::parserInsertBefore(PassRefPtrWillBeRawPtr<Node> newChild, Node& nextChild)

[adamk, 2015/05/01 16:46:53]

Please update the comment in ContainerNode.h, as it claims that this and
parserAppendChild don't handle reparenting.

 {
     ASSERT(newChild);
     ASSERT(nextChild.parentNode() == this);
     ASSERT(!newChild->isDocumentFragment());
     ASSERT(!isHTMLTemplateElement(this));
 
     if (nextChild.previousSibling() == newChild || &nextChild == newChild) // nothing to do
         return;
 
     RefPtrWillBeRawPtr<Node> protect(this);
 
+    // FIXME: parserRemoveChild can run script which could then insert the
+    // newChild back into the page. Loop until the child is actually removed.
+    // See: fast/parser/execute-script-during-adoption-agency-removal.html
+    while (RefPtrWillBeRawPtr<ContainerNode> parent = newChild->parentNode())
+        parent->parserRemoveChild(*newChild);
+
     if (document() != newChild->document())
         document().adoptNode(newChild.get(), ASSERT_NO_EXCEPTION);
 
     {
         EventDispatchForbiddenScope assertNoEventDispatch;
         ScriptForbiddenScope forbidScript;
 
         treeScope().adoptIfNeeded(*newChild);
         insertBeforeCommon(nextChild, *newChild);
         newChild->updateAncestorConnectedSubframeCountForInsertion();
@@ skipping 428 matching lines @@
         updateTreeAfterInsertion(child);
     }
 
     dispatchSubtreeModifiedEvent();
     return newChild;
 }
 
 void ContainerNode::parserAppendChild(PassRefPtrWillBeRawPtr<Node> newChild)
 {
     ASSERT(newChild);
-    ASSERT(!newChild->parentNode()); // Use appendChild if you need to handle reparenting (and want DOM mutation events).

[esprehn, 2015/05/01 05:36:58]

Funny enough this ASSERT wasn't in parserInsertBefore, only parserAppendChild...

[adamk, 2015/05/01 16:46:54]

It's in insertBeforeCommon.

     ASSERT(!newChild->isDocumentFragment());
     ASSERT(!isHTMLTemplateElement(this));
 
     RefPtrWillBeRawPtr<Node> protect(this);
 
+    // FIXME: parserRemoveChild can run script which could then insert the
+    // newChild back into the page. Loop until the child is actually removed.
+    // See: fast/parser/execute-script-during-adoption-agency-removal.html
+    while (RefPtrWillBeRawPtr<ContainerNode> parent = newChild->parentNode())
+        parent->parserRemoveChild(*newChild);
+
     if (document() != newChild->document())
         document().adoptNode(newChild.get(), ASSERT_NO_EXCEPTION);
 
     {
         EventDispatchForbiddenScope assertNoEventDispatch;
         ScriptForbiddenScope forbidScript;
 
         treeScope().adoptIfNeeded(*newChild);
         appendChildCommon(*newChild);
         newChild->updateAncestorConnectedSubframeCountForInsertion();
@@ skipping 721 matching lines @@
         return true;
 
     if (node->isElementNode() && toElement(node)->shadow())
         return true;
 
     return false;
 }
 #endif
 
 } // namespace blink