Make sure named item cache is always valid HTMLCollection::updateIdNameCache()

Source/core/html/HTMLCollection.cpp

Index: Source/core/html/HTMLCollection.cpp
diff --git a/Source/core/html/HTMLCollection.cpp b/Source/core/html/HTMLCollection.cpp
index ba1f4c576b97b4c34afbb783a0955da7c1f8e821..5847f593e6ea1b7673c0472fd0401a79190e64d0 100644
--- a/Source/core/html/HTMLCollection.cpp
+++ b/Source/core/html/HTMLCollection.cpp
@@ -442,17 +442,19 @@ void HTMLCollection::updateIdNameCache() const
     if (hasValidIdNameCache())
         return;
 
-    NamedItemCache& cache = createNamedItemCache();
+    OwnPtr<NamedItemCache> cache = NamedItemCache::create();
     for (Element* element = traverseToFirstElement(); element; element = traverseNextElement(*element)) {
         const AtomicString& idAttrVal = element->getIdAttribute();
         if (!idAttrVal.isEmpty())
-            cache.addElementWithId(idAttrVal, element);
+            cache->addElementWithId(idAttrVal, element);
         if (!element->isHTMLElement())
             continue;
         const AtomicString& nameAttrVal = element->getNameAttribute();
         if (!nameAttrVal.isEmpty() && idAttrVal != nameAttrVal && (type() != DocAll || nameShouldBeVisibleInDocumentAll(toHTMLElement(*element))))
-            cache.addElementWithName(nameAttrVal, element);
+            cache->addElementWithName(nameAttrVal, element);
     }
+    // Set the named item cache last as traversing the tree may cause cache invalidation.
+    setNamedItemCache(cache.release());
 }
 
 void HTMLCollection::namedItems(const AtomicString& name, Vector<RefPtr<Element> >& result) const