Clear TemplateContentDocumentFragment::m_host when HTMLTemplateElement is destroyed

Source/core/html/HTMLTemplateElement.cpp

 /*
  * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 29 matching lines @@
 using namespace HTMLNames;
 
 inline HTMLTemplateElement::HTMLTemplateElement(const QualifiedName& tagName, Document& document)
     : HTMLElement(tagName, document)
 {
     ScriptWrappable::init(this);
 }
 
 HTMLTemplateElement::~HTMLTemplateElement()
 {
+    if (m_content)
+        m_content->clearHost();
 }
 
 PassRefPtr<HTMLTemplateElement> HTMLTemplateElement::create(const QualifiedName& tagName, Document& document)
 {
     return adoptRef(new HTMLTemplateElement(tagName, document));
 }
 
 DocumentFragment* HTMLTemplateElement::content() const
 {
     if (!m_content)
@@ skipping 15 matching lines @@
 
 void HTMLTemplateElement::didMoveToNewDocument(Document* oldDocument)
 {
     HTMLElement::didMoveToNewDocument(oldDocument);
     if (!m_content)
         return;
     document().ensureTemplateDocument().adoptIfNeeded(m_content.get());
 }
 
 } // namespace WebCore