parserInsertBefore and parserRemoveChild should check newChild for a parent.

Source/core/dom/ContainerNode.cpp

Index: Source/core/dom/ContainerNode.cpp
diff --git a/Source/core/dom/ContainerNode.cpp b/Source/core/dom/ContainerNode.cpp
index 651b192dee63a5331d2ac5c1009a1dffc378d8ca..b98275fbb2fc872646d2a7842f88dfe924795c21 100644
--- a/Source/core/dom/ContainerNode.cpp
+++ b/Source/core/dom/ContainerNode.cpp
@@ -85,11 +85,8 @@ void ContainerNode::removeDetachedChildren()
 
 void ContainerNode::parserTakeAllChildrenFrom(ContainerNode& oldParent)
 {
-    while (RefPtrWillBeRawPtr<Node> child = oldParent.firstChild()) {
-        oldParent.parserRemoveChild(*child);
-        treeScope().adoptIfNeeded(*child);
+    while (RefPtrWillBeRawPtr<Node> child = oldParent.firstChild())
         parserAppendChild(child.get());
-    }
 }
 
 ContainerNode::~ContainerNode()
@@ -304,6 +301,12 @@ void ContainerNode::parserInsertBefore(PassRefPtrWillBeRawPtr<Node> newChild, No
 
     RefPtrWillBeRawPtr<Node> protect(this);
 
+    // FIXME: parserRemoveChild can run script which could then insert the
+    // newChild back into the page. Loop until the child is actually removed.
+    // See: fast/parser/execute-script-during-adoption-agency-removal.html
+    while (RefPtrWillBeRawPtr<ContainerNode> parent = newChild->parentNode())
+        parent->parserRemoveChild(*newChild);
+
     if (document() != newChild->document())
         document().adoptNode(newChild.get(), ASSERT_NO_EXCEPTION);
 
@@ -752,12 +755,17 @@ PassRefPtrWillBeRawPtr<Node> ContainerNode::appendChild(PassRefPtrWillBeRawPtr<N
 void ContainerNode::parserAppendChild(PassRefPtrWillBeRawPtr<Node> newChild)
 {
     ASSERT(newChild);
-    ASSERT(!newChild->parentNode()); // Use appendChild if you need to handle reparenting (and want DOM mutation events).
     ASSERT(!newChild->isDocumentFragment());
     ASSERT(!isHTMLTemplateElement(this));
 
     RefPtrWillBeRawPtr<Node> protect(this);
 
+    // FIXME: parserRemoveChild can run script which could then insert the
+    // newChild back into the page. Loop until the child is actually removed.
+    // See: fast/parser/execute-script-during-adoption-agency-removal.html
+    while (RefPtrWillBeRawPtr<ContainerNode> parent = newChild->parentNode())
+        parent->parserRemoveChild(*newChild);
+
     if (document() != newChild->document())
         document().adoptNode(newChild.get(), ASSERT_NO_EXCEPTION);