Accurately update Document node counts on disposing shadow roots.

Source/core/dom/Document.h

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  *           (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
@@ skipping 1015 matching lines @@
     OriginsUsingFeatures::Value& originsUsingFeaturesValue() { return m_originsUsingFeaturesValue; }
 
     NthIndexCache* nthIndexCache() const { return m_nthIndexCache; }
 
     bool isPrivilegedContext(String& errorMessage, const PrivilegeContextCheck = StandardPrivilegeCheck) const override;
 
     ClientHintsPreferences& clientHintsPreferences() { return m_clientHintsPreferences; }
 
     CanvasFontCache* canvasFontCache();
 
-    void incrementNodeCount() { m_nodeCount++; }
+    void incrementNodeCount()
+    {
+        if (isDisposed())

[haraken, 2015/08/23 01:49:44]

I'm just curious but is it possible that insertedInto/removedFrom is called for
a document that has been already disposed?

Also Document::dispose() is removed in oilpan. Are you intentionally using
isDisposed(), or should this be isDetached()?

[sof, 2015/08/23 05:36:54]

We wouldn't be here if removedFrom() couldn't be called on a disposed document;
see associated bug for stacktrace.

And if removedFrom() can be called, then I don't see anything fundamentally that
prevents insertedFrom() (if that's the only place node incrementing ends up
being done) from being invoked either in a disposed state. Hence, making it
behave consistently in a disposed state appears preferable. See ps#1 for an
alternative.

This is only for disposed states (as that's where the node count is reset); I
can make this !ENABLE(OILPAN), if preferable.

+            return;
+        m_nodeCount++;
+    }
     void decrementNodeCount()
     {
+        if (isDisposed())
+            return;
         ASSERT(m_nodeCount > 0);
         m_nodeCount--;
     }
     int nodeCount() const { return m_nodeCount; }
 
     using WeakDocumentSet = WillBeHeapHashSet<RawPtrWillBeWeakMember<Document>>;
     static WeakDocumentSet& liveDocumentSet();
 
 protected:
     Document(const DocumentInit&, DocumentClassFlags = DefaultDocumentClass);
@@ skipping 381 matching lines @@
 DEFINE_TYPE_CASTS(TreeScope, Document, document, true, true);
 
 } // namespace blink
 
 #ifndef NDEBUG
 // Outside the WebCore namespace for ease of invocation from gdb.
 CORE_EXPORT void showLiveDocumentInstances();
 #endif
 
 #endif // Document_h