Node.replaceChild with an empty DocumentFragment should not dispatch DOMSubtreeModified twice.

third_party/WebKit/Source/core/dom/ContainerNode.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2013 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 382 matching lines @@
     if (!checkAcceptChild(newChild, child, exceptionState)) {
         if (exceptionState.hadException())
             return nullptr;
         return child;
     }
 
     NodeVector targets;
     collectChildrenAndRemoveFromOldParent(*newChild, targets, exceptionState);
     if (exceptionState.hadException())
         return nullptr;
+    if (targets.isEmpty())
+        return child;
 
     // Does this yet another check because collectChildrenAndRemoveFromOldParent() fires a MutationEvent.
     if (!checkAcceptChild(newChild, child, exceptionState)) {
         if (exceptionState.hadException())
             return nullptr;
         return child;
     }
 
     if (next)
         insertNodeVector(targets, next, AdoptAndInsertBefore());
@@ skipping 967 matching lines @@
         return true;
 
     if (node->isElementNode() && toElement(node)->shadow())
         return true;
 
     return false;
 }
 #endif
 
 } // namespace blink