Check documentElement conditions in parser* DOM mutation methods

Source/core/dom/ContainerNode.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2013 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 67 matching lines @@
 void ContainerNode::removeDetachedChildren()
 {
     ASSERT(!connectedSubframeCount());
     ASSERT(needsAttach());
     removeDetachedChildrenInContainer(*this);
 }
 #endif
 
 void ContainerNode::parserTakeAllChildrenFrom(ContainerNode& oldParent)
 {
-    while (RefPtrWillBeRawPtr<Node> child = oldParent.firstChild())
+    while (RefPtrWillBeRawPtr<Node> child = oldParent.firstChild()) {
+        // Explicitly remove since appending can fail, but this loop shouldn't be infinite.
+        oldParent.parserRemoveChild(*child);
         parserAppendChild(child.get());
+    }
 }
 
 ContainerNode::~ContainerNode()
 {
     ASSERT(needsAttach());
 #if !ENABLE(OILPAN)
     willBeDeletedFromDocument();
     removeDetachedChildren();
 #endif
 }
@@ skipping 182 matching lines @@
     if (m_lastChild) {
         child.setPreviousSibling(m_lastChild);
         m_lastChild->setNextSibling(&child);
     } else {
         setFirstChild(&child);
     }
 
     setLastChild(&child);
 }
 
+bool ContainerNode::checkParserAcceptChild(const Node& newChild) const
+{
+    if (!isDocumentNode())
+        return true;
+    // TODO(esprehn): Are there other conditions where the parser can create
+    // invalid trees?
+    return toDocument(*this).canAcceptChild(newChild, nullptr, IGNORE_EXCEPTION);
+}
+
 void ContainerNode::parserInsertBefore(PassRefPtrWillBeRawPtr<Node> newChild, Node& nextChild)
 {
     ASSERT(newChild);
     ASSERT(nextChild.parentNode() == this);
     ASSERT(!newChild->isDocumentFragment());
     ASSERT(!isHTMLTemplateElement(this));
 
     if (nextChild.previousSibling() == newChild || &nextChild == newChild) // nothing to do
         return;
 
+    if (!checkParserAcceptChild(*newChild))
+        return;
+
     RefPtrWillBeRawPtr<Node> protect(this);
 
     // FIXME: parserRemoveChild can run script which could then insert the
     // newChild back into the page. Loop until the child is actually removed.
     // See: fast/parser/execute-script-during-adoption-agency-removal.html
     while (RefPtrWillBeRawPtr<ContainerNode> parent = newChild->parentNode())
         parent->parserRemoveChild(*newChild);
 
     if (document() != newChild->document())
         document().adoptNode(newChild.get(), ASSERT_NO_EXCEPTION);
@@ skipping 444 matching lines @@
     dispatchSubtreeModifiedEvent();
     return newChild;
 }
 
 void ContainerNode::parserAppendChild(PassRefPtrWillBeRawPtr<Node> newChild)
 {
     ASSERT(newChild);
     ASSERT(!newChild->isDocumentFragment());
     ASSERT(!isHTMLTemplateElement(this));
 
+    if (!checkParserAcceptChild(*newChild))
+        return;
+
     RefPtrWillBeRawPtr<Node> protect(this);
 
     // FIXME: parserRemoveChild can run script which could then insert the
     // newChild back into the page. Loop until the child is actually removed.
     // See: fast/parser/execute-script-during-adoption-agency-removal.html
     while (RefPtrWillBeRawPtr<ContainerNode> parent = newChild->parentNode())
         parent->parserRemoveChild(*newChild);
 
     if (document() != newChild->document())
         document().adoptNode(newChild.get(), ASSERT_NO_EXCEPTION);
@@ skipping 727 matching lines @@
         return true;
 
     if (node->isElementNode() && toElement(node)->shadow())
         return true;
 
     return false;
 }
 #endif
 
 } // namespace blink