Don't call Document::nodeWillRemoved() with a node in different document

Source/core/dom/ContainerNode.cpp

Index: Source/core/dom/ContainerNode.cpp
diff --git a/Source/core/dom/ContainerNode.cpp b/Source/core/dom/ContainerNode.cpp
index 070befc354fafaac6d3c7ca80832b99221d00764..90fb8b95765b2b14cd01fa75d3bc6bcc2658450c 100644
--- a/Source/core/dom/ContainerNode.cpp
+++ b/Source/core/dom/ContainerNode.cpp
@@ -438,12 +438,18 @@ void ContainerNode::willRemoveChild(Node& child)
     child.notifyMutationObserversNodeWillDetach();
     dispatchChildRemovalEvents(child);
     ChildFrameDisconnector(child).disconnect();
+    if (document() != child.document()) {
+        // |child| was moved another document by DOM mutation event handler.
+        return;
+    }
 
-    // nodeWillBeRemoved must be run after ChildFrameDisconnector, because ChildFrameDisconnector can run script
-    // which may cause state that is to be invalidated by removing the node.
+    // |nodeWillBeRemoved()| must be run after |ChildFrameDisconnector|, because
+    // |ChildFrameDisconnector| can run script which may cause state that is to
+    // be invalidated by removing the node.
     ScriptForbiddenScope scriptForbiddenScope;
     EventDispatchForbiddenScope assertNoEventDispatch;
-    document().nodeWillBeRemoved(child); // e.g. mutation event listener can create a new range.
+    // e.g. mutation event listener can create a new range.
+    document().nodeWillBeRemoved(child);
 }
 
 void ContainerNode::willRemoveChildren()