Fix the condition to call removePandingSheet() in LinkStyle::setCSSStyleSheet

third_party/WebKit/Source/core/html/HTMLLinkElement.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2003, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2009 Rob Buis (rwlbuis@gmail.com)
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ skipping 422 matching lines @@
 
 enum StyleSheetCacheStatus {
     StyleSheetNewEntry,
     StyleSheetInDiskCache,
     StyleSheetInMemoryCache,
     StyleSheetCacheStatusCount,
 };
 
 void LinkStyle::setCSSStyleSheet(const String& href, const KURL& baseURL, const String& charset, const CSSStyleSheetResource* cachedStyleSheet)
 {
-    if (!m_owner->isConnected()) {
-        ASSERT(!m_sheet);
+    if (!m_owner->isInDocumentTree()) {
+        // While the stylesheet is asynchronously loading, the owner can be moved out of a document tree.
+        // In that case, cancel any processing on the loaded content.
+        m_loading = false;
+        removePendingSheet();
+        if (m_sheet)
+            clearSheet();
         return;
     }
 
     // See the comment in PendingScript.cpp about why this check is necessary
     // here, instead of in the resource fetcher. https://crbug.com/500701.
     if (!cachedStyleSheet->errorOccurred() && m_owner->fastHasAttribute(HTMLNames::integrityAttr) && cachedStyleSheet->resourceBuffer() && !SubresourceIntegrity::CheckSubresourceIntegrity(*m_owner, cachedStyleSheet->resourceBuffer()->data(), cachedStyleSheet->resourceBuffer()->size(), KURL(baseURL, href), *cachedStyleSheet)) {
         m_loading = false;
         removePendingSheet();
         notifyLoadedSheetAndAllCriticalSubresources(Node::ErrorOccurredLoadingSubresource);
         return;
     }
-    // While the stylesheet is asynchronously loading, the owner can be moved under
-    // shadow tree.  In that case, cancel any processing on the loaded content.
-    if (m_owner->isInShadowTree()) {
-        m_loading = false;
-        removePendingSheet();
-        if (m_sheet)
-            clearSheet();
-        return;
-    }
 
     CSSParserContext parserContext(m_owner->document(), nullptr, baseURL, charset);
 
     DEFINE_STATIC_LOCAL(EnumerationHistogram, restoredCachedStyleSheetHistogram, ("Blink.RestoredCachedStyleSheet", 2));
     DEFINE_STATIC_LOCAL(EnumerationHistogram, restoredCachedStyleSheet2Histogram, ("Blink.RestoredCachedStyleSheet2", StyleSheetCacheStatusCount));
 
     if (StyleSheetContents* restoredSheet = const_cast<CSSStyleSheetResource*>(cachedStyleSheet)->restoreParsedStyleSheet(parserContext)) {
         ASSERT(restoredSheet->isCacheableForResource());
         ASSERT(!restoredSheet->isLoading());
 
@@ skipping 253 matching lines @@
 }
 
 DEFINE_TRACE(LinkStyle)
 {
     visitor->trace(m_sheet);
     LinkResource::trace(visitor);
     ResourceOwner<StyleSheetResource>::trace(visitor);
 }
 
 } // namespace blink