Clear TemplateContentDocumentFragment::m_host when HTMLTemplateElement is destroyed

Source/core/dom/TemplateContentDocumentFragment.h

 /*
  * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Neither the name of Google Inc. nor the names of its
@@ skipping 21 matching lines @@
 namespace WebCore {
 
 class TemplateContentDocumentFragment FINAL : public DocumentFragment {
 public:
     static PassRefPtr<TemplateContentDocumentFragment> create(Document& document, const Element* host)
     {
         return adoptRef(new TemplateContentDocumentFragment(document, host));
     }
 
     const Element* host() const { return m_host; }
+    void clearHost() { m_host = 0; }
 
 private:
     TemplateContentDocumentFragment(Document& document, const Element* host)
         : DocumentFragment(&document, CreateDocumentFragment)
         , m_host(host)
     {
     }
 
     virtual bool isTemplateContent() const OVERRIDE { return true; }
 
     const Element* m_host;
 };
 
 } // namespace WebCore
 
 #endif // TemplateContentDocumentFragment_h