Elements moved from a shadow root to a detached tree should clear their IsInShadowTree Flag

Source/core/dom/Element.h

Index: Source/core/dom/Element.h
diff --git a/Source/core/dom/Element.h b/Source/core/dom/Element.h
index 221c8aeec54020548e849dbeca693885cb853535..0f02ebf58a95b6442ac9a859f4672e5985506703 100644
--- a/Source/core/dom/Element.h
+++ b/Source/core/dom/Element.h
@@ -796,7 +796,7 @@ inline Node::InsertionNotificationRequest Node::insertedInto(ContainerNode* inse
 
 inline void Node::removedFrom(ContainerNode* insertionPoint)
 {
-    ASSERT(insertionPoint->inDocument() || isContainerNode());
+    ASSERT(insertionPoint->inDocument() || isContainerNode() || isInShadowTree());

[rhogan, 2015/06/24 20:34:41]

I didn't use isInTreeScope() here as it would expand the ASSERT to allow
inDocument() as an alternative to insertionPoint->inDocument, and that appears
to be unnecessary.

     if (insertionPoint->inDocument())
         clearFlag(InDocumentFlag);
     if (isInShadowTree() && !treeScope().rootNode().isShadowRoot())