parserRemoveChild: Avoid unintended DOM modifications after user script run

parserRemoveChild: Avoid unintended DOM modifications after user script run.

Surprisingly, ContainerNode::parserRemoveChild may run arbitrary user script during its DOM modification if its target contained iframes.
Before this CL, this could lead to corrupt DOM tree, as the target node could be moved during parserRemoveChild execution.

This CL adds a bail-out if stmt after disconnecting child frame to abort if precondition has changed.

BUG=516377
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=200098

[kouhei (in TOK), 2015-08-06 04:35:50]

kouhei@chromium.org changed reviewers:
+ tkent@chromium.org, yutak@chromium.org

[kouhei (in TOK), 2015-08-06 04:35:58]

PTAL

[tkent, 2015-08-06 05:27:58]

lgtm

[kouhei (in TOK), 2015-08-06 05:28:20]

The CQ bit was checked by kouhei@chromium.org

[commit-bot: I haz the power, 2015-08-06 05:28:38]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1277793002/20001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1277793002/20001

[commit-bot: I haz the power, 2015-08-06 06:10:16]

Committed patchset #2 (id:20001) as
https://src.chromium.org/viewvc/blink?view=rev&revision=200098