parserRemoveChild: Avoid unintended DOM modifications after user script run

Source/core/dom/ContainerNode.cpp

Index: Source/core/dom/ContainerNode.cpp
diff --git a/Source/core/dom/ContainerNode.cpp b/Source/core/dom/ContainerNode.cpp
index ef20bb6ea9237c822c4032474b4d2f068026a3a3..1c46d51413199c8ad2d3c3974aa7b102cd3afeb1 100644
--- a/Source/core/dom/ContainerNode.cpp
+++ b/Source/core/dom/ContainerNode.cpp
@@ -620,15 +620,18 @@ void ContainerNode::parserRemoveChild(Node& oldChild)
     ASSERT(oldChild.parentNode() == this);
     ASSERT(!oldChild.isDocumentFragment());
 
-    Node* prev = oldChild.previousSibling();
-    Node* next = oldChild.nextSibling();
-
+    // This may cause arbitrary Javascript execution via onunload handlers.
     if (oldChild.connectedSubframeCount())
         ChildFrameDisconnector(oldChild).disconnect();
 
+    if (oldChild.parentNode() != this)
+        return;
+
     ChildListMutationScope(*this).willRemoveChild(oldChild);
     oldChild.notifyMutationObserversNodeWillDetach();
 
+    Node* prev = oldChild.previousSibling();
+    Node* next = oldChild.nextSibling();
     removeBetween(prev, next, oldChild);
 
     notifyNodeRemoved(oldChild);