Handle some failing DocumentOrderedMap ID lookups across tree removals.

third_party/WebKit/Source/core/dom/ContainerNode.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2013 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 568 matching lines @@
     willRemoveChild(*child);
 
     // Mutation events might have moved this child into a different parent.
     if (child->parentNode() != this) {
         exceptionState.throwDOMException(NotFoundError, "The node to be removed is no longer a child of this node. Perhaps it was moved in response to a mutation?");
         return nullptr;
     }
 
     {
         HTMLFrameOwnerElement::UpdateSuspendScope suspendWidgetHierarchyUpdates;
+        DocumentOrderedMap::RemoveScope treeRemoveScope;
 
         Node* prev = child->previousSibling();
         Node* next = child->nextSibling();
         removeBetween(prev, next, *child);
         notifyNodeRemoved(*child);
         childrenChanged(ChildrenChange::forRemoval(*child, prev, next, ChildrenChangeSourceAPI));
     }
     dispatchSubtreeModifiedEvent();
     return child;
 }
@@ skipping 32 matching lines @@
     if (oldChild.connectedSubframeCount())
         ChildFrameDisconnector(oldChild).disconnect();
 
     if (oldChild.parentNode() != this)
         return;
 
     ChildListMutationScope(*this).willRemoveChild(oldChild);
     oldChild.notifyMutationObserversNodeWillDetach();
 
     HTMLFrameOwnerElement::UpdateSuspendScope suspendWidgetHierarchyUpdates;
+    DocumentOrderedMap::RemoveScope treeRemoveScope;
+
     Node* prev = oldChild.previousSibling();
     Node* next = oldChild.nextSibling();
     removeBetween(prev, next, oldChild);
 
     notifyNodeRemoved(oldChild);
     childrenChanged(ChildrenChange::forRemoval(oldChild, prev, next, ChildrenChangeSourceParser));
 }
 
 // This differs from other remove functions because it forcibly removes all the children,
 // regardless of read-only status or event exceptions, e.g.
@@ skipping 27 matching lines @@
 #if !ENABLE(OILPAN)
     // FIXME: Remove this NodeVector. Right now WebPluginContainerImpl::m_element is a
     // raw ptr which means the code below can drop the last ref to a plugin element and
     // then the code in UpdateSuspendScope::performDeferredWidgetTreeOperations will
     // try to destroy the plugin which will be a use-after-free. We should use a RefPtr
     // in the WebPluginContainerImpl instead.
     NodeVector removedChildren;
 #endif
     {
         HTMLFrameOwnerElement::UpdateSuspendScope suspendWidgetHierarchyUpdates;
-
+        DocumentOrderedMap::RemoveScope treeRemoveScope;
         {
             EventDispatchForbiddenScope assertNoEventDispatch;
             ScriptForbiddenScope forbidScript;
 
 #if !ENABLE(OILPAN)
             removedChildren.reserveInitialCapacity(countChildren());
 #endif
             while (RefPtrWillBeRawPtr<Node> child = m_firstChild) {
                 removeBetween(0, child->nextSibling(), *child);
 #if !ENABLE(OILPAN)
@@ skipping 835 matching lines @@
         return true;
 
     if (node->isElementNode() && toElement(node)->shadow())
         return true;
 
     return false;
 }
 #endif
 
 } // namespace blink