Don't call ill-balanced removeStyleSheetCandidateNode()

Source/core/dom/StyleElement.cpp

 /*
  * Copyright (C) 2006, 2007 Rob Buis
  * Copyright (C) 2008 Apple, Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
@@ skipping 25 matching lines @@
 namespace WebCore {
 
 static bool isCSS(Element* element, const AtomicString& type)
 {
     return type.isEmpty() || (element->isHTMLElement() ? equalIgnoringCase(type, "text/css") : (type == "text/css"));
 }
 
 StyleElement::StyleElement(Document* document, bool createdByParser)
     : m_createdByParser(createdByParser)
     , m_loading(false)
+    , m_registeredAsCandidate(false)
     , m_startPosition(TextPosition::belowRangePosition())
 {
     if (createdByParser && document && document->scriptableDocumentParser() && !document->isInDocumentWrite())
         m_startPosition = document->scriptableDocumentParser()->textPosition();
 }
 
 StyleElement::~StyleElement()
 {
     if (m_sheet)
         clearSheet();
 }
 
 void StyleElement::processStyleSheet(Document& document, Element* element)
 {
     TRACE_EVENT0("webkit", "StyleElement::processStyleSheet");
     ASSERT(element);
+
+    m_registeredAsCandidate = true;
     document.styleEngine()->addStyleSheetCandidateNode(element, m_createdByParser);
     if (m_createdByParser)
         return;
 
     process(element);
 }
 
 void StyleElement::removedFromDocument(Document& document, Element* element)
 {
     removedFromDocument(document, element, 0, document);
 }
 
 void StyleElement::removedFromDocument(Document& document, Element* element, ContainerNode* scopingNode, TreeScope& treeScope)
 {
     ASSERT(element);
+
+    if (!m_registeredAsCandidate) {
+        ASSERT(!m_sheet);
+        return;
+    }
+
     document.styleEngine()->removeStyleSheetCandidateNode(element, scopingNode, treeScope);
+    m_registeredAsCandidate = false;
 
     RefPtr<StyleSheet> removedSheet = m_sheet;
 
     if (m_sheet)
         clearSheet(element);
 
     document.removedStyleSheet(removedSheet.get(), RecalcStyleDeferred, AnalyzedStyleUpdate);
 }
 
 void StyleElement::clearDocumentData(Document& document, Element* element)
@@ skipping 85 matching lines @@
     document.styleEngine()->removePendingSheet(m_sheet->ownerNode());
     return true;
 }
 
 void StyleElement::startLoadingDynamicSheet(Document& document)
 {
     document.styleEngine()->addPendingSheet();
 }
 
 }