Clear TemplateContentDocumentFragment::m_host when HTMLTemplateElement is destroyed

Source/core/html/HTMLTemplateElement.h

Index: Source/core/html/HTMLTemplateElement.h
diff --git a/Source/core/html/HTMLTemplateElement.h b/Source/core/html/HTMLTemplateElement.h
index cff122734fe2a55be359d63adf4d6d133b5e66ea..82a48468b7e57c9ad325c5852541a8f6a866b0b7 100644
--- a/Source/core/html/HTMLTemplateElement.h
+++ b/Source/core/html/HTMLTemplateElement.h
@@ -31,11 +31,13 @@
 #ifndef HTMLTemplateElement_h
 #define HTMLTemplateElement_h
 
-#include "core/dom/DocumentFragment.h"
 #include "core/html/HTMLElement.h"
 
 namespace WebCore {
 
+class DocumentFragment;
+class TemplateContentDocumentFragment;
+
 class HTMLTemplateElement FINAL : public HTMLElement {
 public:
     static PassRefPtr<HTMLTemplateElement> create(const QualifiedName&, Document&);
@@ -49,7 +51,7 @@ private:
 
     HTMLTemplateElement(const QualifiedName&, Document&);
 
-    mutable RefPtr<DocumentFragment> m_content;
+    mutable RefPtr<TemplateContentDocumentFragment> m_content;
 };
 
 inline HTMLTemplateElement* toHTMLTemplateElement(Node* node)