Post-Mutation Event checks must re-check document constraints.

Source/core/dom/ContainerNode.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2013 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 127 matching lines @@
         return true;
     }
 
     // This should never happen, but also protect release builds from tree corruption.
     ASSERT(!newChild->isPseudoElement());
     if (newChild->isPseudoElement()) {
         exceptionState.throwDOMException(HierarchyRequestError, "The new child element is a pseudo-element.");
         return false;
     }
 
-    if (containsConsideringHostElements(*newChild)) {
+    return checkAcceptChildGuaranteedNodeTypes(*newChild, oldChild, exceptionState);
+}
+
+bool ContainerNode::checkAcceptChildGuaranteedNodeTypes(const Node& newChild, const Node* oldChild, ExceptionState& exceptionState) const
+{
+    if (isDocumentNode())
+        return toDocument(this)->canAcceptChild(newChild, oldChild, exceptionState);
+    if (!isChildTypeAllowed(newChild)) {
+        exceptionState.throwDOMException(HierarchyRequestError, "Nodes of type '" + newChild.nodeName() + "' may not be inserted inside nodes of type '" + nodeName() + "'.");
+        return false;
+    }
+    if (newChild.containsIncludingHostElements(*this)) {
         exceptionState.throwDOMException(HierarchyRequestError, "The new child element contains the parent.");
         return false;
     }
-
-    if (isDocumentNode())
-        return toDocument(this)->canAcceptChild(*newChild, oldChild, exceptionState);
-
-    if (!isChildTypeAllowed(*newChild)) {
-        exceptionState.throwDOMException(HierarchyRequestError, "Nodes of type '" + newChild->nodeName() + "' may not be inserted inside nodes of type '" + nodeName() + "'.");
-        return false;
-    }
-
-    return true;
-}
-
-bool ContainerNode::checkAcceptChildGuaranteedNodeTypes(const Node& newChild, ExceptionState& exceptionState) const
-{
-    ASSERT(isChildTypeAllowed(newChild));
-    if (newChild.contains(this)) {
-        exceptionState.throwDOMException(HierarchyRequestError, "The new child element contains the parent.");
-        return false;
-    }
     return true;
 }
 
 PassRefPtrWillBeRawPtr<Node> ContainerNode::insertBefore(PassRefPtrWillBeRawPtr<Node> newChild, Node* refChild, ExceptionState& exceptionState)
 {
 #if !ENABLE(OILPAN)
     // Check that this node is not "floating".
     // If it is, it can be deleted as a side effect of sending mutation events.
     ASSERT(refCount() || parentOrShadowHostNode());
 #endif
@@ skipping 26 matching lines @@
     RefPtrWillBeRawPtr<Node> next = refChild;
 
     NodeVector targets;
     collectChildrenAndRemoveFromOldParent(*newChild, targets, exceptionState);
     if (exceptionState.hadException())
         return nullptr;
     if (targets.isEmpty())
         return newChild;
 
     // We need this extra check because collectChildrenAndRemoveFromOldParent() can fire mutation events.
-    if (!checkAcceptChildGuaranteedNodeTypes(*newChild, exceptionState)) {
+    if (!checkAcceptChildGuaranteedNodeTypes(*newChild, nullptr, exceptionState)) {
         if (exceptionState.hadException())
             return nullptr;
         return newChild;
     }
 
     InspectorInstrumentation::willInsertDOMNode(this);
 
     ChildListMutationScope mutation(*this);
     for (const auto& targetNode : targets) {
         ASSERT(targetNode);
@@ skipping 502 matching lines @@
 
     NodeVector targets;
     collectChildrenAndRemoveFromOldParent(*newChild, targets, exceptionState);
     if (exceptionState.hadException())
         return nullptr;
 
     if (targets.isEmpty())
         return newChild;
 
     // We need this extra check because collectChildrenAndRemoveFromOldParent() can fire mutation events.
-    if (!checkAcceptChildGuaranteedNodeTypes(*newChild, exceptionState)) {
+    if (!checkAcceptChildGuaranteedNodeTypes(*newChild, nullptr, exceptionState)) {
         if (exceptionState.hadException())
             return nullptr;
         return newChild;
     }
 
     InspectorInstrumentation::willInsertDOMNode(this);
 
     // Now actually add the child(ren).
     ChildListMutationScope mutation(*this);
     for (const auto& targetNode : targets) {
@@ skipping 771 matching lines @@
         return true;
 
     if (node->isElementNode() && toElement(node)->shadow())
         return true;
 
     return false;
 }
 #endif
 
 } // namespace blink