Accurately update Document node counts on disposing shadow roots.

Source/core/dom/ContainerNode.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2013 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 495 matching lines @@
         ASSERT_WITH_SECURITY_IMPLICATION(!n->m_deletionHasBegun);
 
         next = n->nextSibling();
         n->setNextSibling(nullptr);
         n->setParentOrShadowHostNode(nullptr);
         container.setFirstChild(next);
         if (next)
             next->setPreviousSibling(nullptr);
 
         if (!n->refCount()) {
+            if (n->inDocument())
+                container.document().decrementNodeCount();
+
 #if ENABLE(SECURITY_ASSERT)
             n->m_deletionHasBegun = true;
 #endif
             // Add the node to the list of nodes to be deleted.
             // Reuse the nextSibling pointer for this purpose.
             if (tail)
                 tail->setNextSibling(n);
             else
                 head = n;
 
@@ skipping 997 matching lines @@
         return true;
 
     if (node->isElementNode() && toElement(node)->shadow())
         return true;
 
     return false;
 }
 #endif
 
 } // namespace blink