parserRemoveChild: Avoid unintended DOM modifications after user script run

Source/core/dom/ContainerNode.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2013 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 602 matching lines @@
     oldChild.setParentOrShadowHostNode(nullptr);
 
     document().adoptIfNeeded(oldChild);
 }
 
 void ContainerNode::parserRemoveChild(Node& oldChild)
 {
     ASSERT(oldChild.parentNode() == this);
     ASSERT(!oldChild.isDocumentFragment());
 
-    Node* prev = oldChild.previousSibling();
-    Node* next = oldChild.nextSibling();
-
+    // This may cause arbitrary Javascript execution via onunload handlers.
     if (oldChild.connectedSubframeCount())
         ChildFrameDisconnector(oldChild).disconnect();
 
+    if (oldChild.parentNode() != this)
+        return;
+
     ChildListMutationScope(*this).willRemoveChild(oldChild);
     oldChild.notifyMutationObserversNodeWillDetach();
 
+    Node* prev = oldChild.previousSibling();
+    Node* next = oldChild.nextSibling();
     removeBetween(prev, next, oldChild);
 
     notifyNodeRemoved(oldChild);
     childrenChanged(ChildrenChange::forRemoval(oldChild, prev, next, ChildrenChangeSourceParser));
 }
 
 // This differs from other remove functions because it forcibly removes all the children,
 // regardless of read-only status or event exceptions, e.g.
 void ContainerNode::removeChildren(SubtreeModificationAction action)
 {
@@ skipping 869 matching lines @@
         return true;
 
     if (node->isElementNode() && toElement(node)->shadow())
         return true;
 
     return false;
 }
 #endif
 
 } // namespace blink