Check documentElement conditions in parser* DOM mutation methods

Source/core/dom/ContainerNode.cpp

Index: Source/core/dom/ContainerNode.cpp
diff --git a/Source/core/dom/ContainerNode.cpp b/Source/core/dom/ContainerNode.cpp
index cfbe083d297fa80cef24edb9d062aa92c1ab508d..a759ec6a9c2cc1f579def6d5b02a2e271385356c 100644
--- a/Source/core/dom/ContainerNode.cpp
+++ b/Source/core/dom/ContainerNode.cpp
@@ -85,8 +85,11 @@ void ContainerNode::removeDetachedChildren()
 
 void ContainerNode::parserTakeAllChildrenFrom(ContainerNode& oldParent)
 {
-    while (RefPtrWillBeRawPtr<Node> child = oldParent.firstChild())
+    while (RefPtrWillBeRawPtr<Node> child = oldParent.firstChild()) {
+        // Explicitly remove since appending can fail, but this loop shouldn't be infinite.
+        oldParent.parserRemoveChild(*child);
         parserAppendChild(child.get());
+    }
 }
 
 ContainerNode::~ContainerNode()
@@ -289,6 +292,15 @@ void ContainerNode::appendChildCommon(Node& child)
     setLastChild(&child);
 }
 
+bool ContainerNode::checkParserAcceptChild(const Node& newChild) const
+{
+    if (!isDocumentNode())
+        return true;
+    // TODO(esprehn): Are there other conditions where the parser can create
+    // invalid trees?
+    return toDocument(*this).canAcceptChild(newChild, nullptr, IGNORE_EXCEPTION);
+}
+
 void ContainerNode::parserInsertBefore(PassRefPtrWillBeRawPtr<Node> newChild, Node& nextChild)
 {
     ASSERT(newChild);
@@ -299,6 +311,9 @@ void ContainerNode::parserInsertBefore(PassRefPtrWillBeRawPtr<Node> newChild, No
     if (nextChild.previousSibling() == newChild || &nextChild == newChild) // nothing to do
         return;
 
+    if (!checkParserAcceptChild(*newChild))
+        return;
+
     RefPtrWillBeRawPtr<Node> protect(this);
 
     // FIXME: parserRemoveChild can run script which could then insert the
@@ -763,6 +778,9 @@ void ContainerNode::parserAppendChild(PassRefPtrWillBeRawPtr<Node> newChild)
     ASSERT(!newChild->isDocumentFragment());
     ASSERT(!isHTMLTemplateElement(this));
 
+    if (!checkParserAcceptChild(*newChild))
+        return;
+
     RefPtrWillBeRawPtr<Node> protect(this);
 
     // FIXME: parserRemoveChild can run script which could then insert the