Accurately update Document node counts on disposing shadow roots.

Source/core/dom/Document.h

Index: Source/core/dom/Document.h
diff --git a/Source/core/dom/Document.h b/Source/core/dom/Document.h
index 06d11412b547afa6c44ebf02e7659dca081286f8..579a74e377e5b352008454f5ddb2e11de5791dd3 100644
--- a/Source/core/dom/Document.h
+++ b/Source/core/dom/Document.h
@@ -1033,9 +1033,16 @@ public:
 
     CanvasFontCache* canvasFontCache();
 
-    void incrementNodeCount() { m_nodeCount++; }
+    void incrementNodeCount()
+    {
+        if (isDisposed())

[haraken, 2015/08/23 01:49:44]

I'm just curious but is it possible that insertedInto/removedFrom is called for
a document that has been already disposed?

Also Document::dispose() is removed in oilpan. Are you intentionally using
isDisposed(), or should this be isDetached()?

[sof, 2015/08/23 05:36:54]

We wouldn't be here if removedFrom() couldn't be called on a disposed document;
see associated bug for stacktrace.

And if removedFrom() can be called, then I don't see anything fundamentally that
prevents insertedFrom() (if that's the only place node incrementing ends up
being done) from being invoked either in a disposed state. Hence, making it
behave consistently in a disposed state appears preferable. See ps#1 for an
alternative.

This is only for disposed states (as that's where the node count is reset); I
can make this !ENABLE(OILPAN), if preferable.

+            return;
+        m_nodeCount++;
+    }
     void decrementNodeCount()
     {
+        if (isDisposed())
+            return;
         ASSERT(m_nodeCount > 0);
         m_nodeCount--;
     }