Node.replaceChild with an empty DocumentFragment should not dispatch DOMSubtreeModified twice.

third_party/WebKit/Source/core/dom/ContainerNode.cpp

Index: third_party/WebKit/Source/core/dom/ContainerNode.cpp
diff --git a/third_party/WebKit/Source/core/dom/ContainerNode.cpp b/third_party/WebKit/Source/core/dom/ContainerNode.cpp
index b277ab739a8557379fe8f239435a01058b647837..1d568780e071c72e464b81f5d42ea7131d78e781 100644
--- a/third_party/WebKit/Source/core/dom/ContainerNode.cpp
+++ b/third_party/WebKit/Source/core/dom/ContainerNode.cpp
@@ -400,6 +400,8 @@ Node* ContainerNode::replaceChild(Node* newChild, Node* oldChild, ExceptionState
     collectChildrenAndRemoveFromOldParent(*newChild, targets, exceptionState);
     if (exceptionState.hadException())
         return nullptr;
+    if (targets.isEmpty())
+        return child;
 
     // Does this yet another check because collectChildrenAndRemoveFromOldParent() fires a MutationEvent.
     if (!checkAcceptChild(newChild, child, exceptionState)) {