Don't call ill-balanced removeStyleSheetCandidateNode()

Source/core/dom/StyleElement.cpp

Index: Source/core/dom/StyleElement.cpp
diff --git a/Source/core/dom/StyleElement.cpp b/Source/core/dom/StyleElement.cpp
index c16c57fb3399988fe8c957af152d4fb0c8ed173b..bf5767f92e428864604c702d64438ef0d5bc381a 100644
--- a/Source/core/dom/StyleElement.cpp
+++ b/Source/core/dom/StyleElement.cpp
@@ -43,6 +43,7 @@ static bool isCSS(Element* element, const AtomicString& type)
 StyleElement::StyleElement(Document* document, bool createdByParser)
     : m_createdByParser(createdByParser)
     , m_loading(false)
+    , m_registeredAsCandidate(false)
     , m_startPosition(TextPosition::belowRangePosition())
 {
     if (createdByParser && document && document->scriptableDocumentParser() && !document->isInDocumentWrite())
@@ -59,6 +60,8 @@ void StyleElement::processStyleSheet(Document& document, Element* element)
 {
     TRACE_EVENT0("webkit", "StyleElement::processStyleSheet");
     ASSERT(element);
+
+    m_registeredAsCandidate = true;
     document.styleEngine()->addStyleSheetCandidateNode(element, m_createdByParser);
     if (m_createdByParser)
         return;
@@ -74,7 +77,14 @@ void StyleElement::removedFromDocument(Document& document, Element* element)
 void StyleElement::removedFromDocument(Document& document, Element* element, ContainerNode* scopingNode, TreeScope& treeScope)
 {
     ASSERT(element);
+
+    if (!m_registeredAsCandidate) {
+        ASSERT(!m_sheet);
+        return;
+    }
+
     document.styleEngine()->removeStyleSheetCandidateNode(element, scopingNode, treeScope);
+    m_registeredAsCandidate = false;
 
     RefPtr<StyleSheet> removedSheet = m_sheet;