Added addXSLStyleSheet and removeXSLStyleSheet to StyleEngine.

Source/core/dom/ProcessingInstruction.cpp

 /*
  * Copyright (C) 2000 Peter Kelly (pmk@post.com)
  * Copyright (C) 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
@@ skipping 41 matching lines @@
 {
     return adoptRefWillBeRefCountedGarbageCollected(new ProcessingInstruction(document, target, data));
 }
 
 ProcessingInstruction::~ProcessingInstruction()
 {
 #if !ENABLE(OILPAN)
     if (m_sheet)
         m_sheet->clearOwnerNode();
 
-    if (inDocument())
-        document().styleEngine()->removeStyleSheetCandidateNode(this);
+    if (inDocument()) {

[esprehn, 2014/06/06 01:32:55]

This does doesn't make any sense, you can't be inDocument() if your destructor
is running. I don't understand the old code either.

[tasak, 2014/06/09 04:04:57]

I would like to attach crash log when I added ASSERT(!inDocument()); here:

STDOUT: #CRASHED - renderer (pid 19995)
STDERR: ASSERTION FAILED: !inDocument()
STDERR: ../../third_party/WebKit/Source/core/dom/ProcessingInstruction.cpp(62) :
virtual WebCore::ProcessingInstruction::~ProcessingInstruction()

STDERR: #3 0x000002143103
WebCore::ProcessingInstruction::~ProcessingInstruction()
STDERR: #4 0x000002143279
WebCore::ProcessingInstruction::~ProcessingInstruction()
STDERR: #5 0x000002063835 WebCore::removeDetachedChildrenInContainer<>()
STDERR: #6 0x00000205d7bb WebCore::ContainerNode::removeDetachedChildren()
STDERR: #7 0x00000207665c WebCore::Document::dispose()
STDERR: #8 0x00000207685c WebCore::Document::dispose()
STDERR: #9 0x000002129af4 WebCore::TreeScope::removedLastRefToScope()
STDERR: #10 0x000002125da7 WebCore::Node::removedLastRef()
STDERR: #11 0x000001f90647 WebCore::TreeShared<>::deref()
STDERR: #12 0x000001f9041d WTF::derefIfNotNull<>()
STDERR: #13 0x000001f94238 WTF::RefPtr<>::~RefPtr()
STDERR: #14 0x0000029fa7ae WebCore::XMLHttpRequest::~XMLHttpRequest()
STDERR: #15 0x0000029fa979 WebCore::XMLHttpRequest::~XMLHttpRequest()
STDERR: #16 0x0000029029d3 WTF::RefCounted<>::deref()
STDERR: #17 0x00000310fb63 WebCore::V8XMLHttpRequest::derefObject()
STDERR: #18 0x000002fa3db8 WebCore::releaseObject()
STDERR: #19 0x000002fb4a89 WebCore::ScriptWrappable::setWeakCallback()
STDERR: #20 0x000001b7b172
v8::internal::GlobalHandles::Node::PostGarbageCollectionProcessing()
STDERR: #21 0x000001b7abfc
v8::internal::GlobalHandles::PostGarbageCollectionProcessing()
STDERR: #22 0x000001ba32df v8::internal::Heap::PerformGarbageCollection()
STDERR: #23 0x000001ba274e v8::internal::Heap::CollectGarbage()
STDERR: #24 0x000001ba224e v8::internal::Heap::CollectAllGarbage()

I think, probably ProcessingInstruction and XSLT are not maintained correctly.
So currently, we will see inDocument() in ~ProcessingInstruction.

I added FIXME.

+        if (m_isCSS)
+            document().styleEngine()->removeStyleSheetCandidateNode(this);
+        else if (m_isXSL)
+            document().styleEngine()->removeXSLStyleSheet(this);
+    }
 #endif
 }
 
 String ProcessingInstruction::nodeName() const
 {
     return m_target;
 }
 
 Node::NodeType ProcessingInstruction::nodeType() const
 {
@@ skipping 161 matching lines @@
 }
 
 Node::InsertionNotificationRequest ProcessingInstruction::insertedInto(ContainerNode* insertionPoint)
 {
     CharacterData::insertedInto(insertionPoint);
     if (!insertionPoint->inDocument())
         return InsertionDone;
 
     String href;
     String charset;
-    // To make it possible for us to see isXSL in
-    // StyleEngine::addStyleSheetCandidateNode, split checkStyleSheet
-    // into two methods, checkStyleSheet and process.
     bool isValid = checkStyleSheet(href, charset);
-    document().styleEngine()->addStyleSheetCandidateNode(this, m_createdByParser);
+    if (m_isCSS)
+        document().styleEngine()->addStyleSheetCandidateNode(this, m_createdByParser);
+    else if (m_isXSL)
+        document().styleEngine()->addXSLStyleSheet(this, m_createdByParser);
     if (isValid)
         process(href, charset);
     return InsertionDone;
 }
 
 void ProcessingInstruction::removedFrom(ContainerNode* insertionPoint)
 {
     CharacterData::removedFrom(insertionPoint);
     if (!insertionPoint->inDocument())
         return;
 
-    document().styleEngine()->removeStyleSheetCandidateNode(this);
+    if (m_isCSS)
+        document().styleEngine()->removeStyleSheetCandidateNode(this);
+    else if (m_isXSL)
+        document().styleEngine()->removeXSLStyleSheet(this);
 
     RefPtrWillBeRawPtr<StyleSheet> removedSheet = m_sheet;
 
     if (m_sheet) {
         ASSERT(m_sheet->ownerNode() == this);
         m_sheet->clearOwnerNode();
         m_sheet = nullptr;
     }
 
     // If we're in document teardown, then we don't need to do any notification of our sheet's removal.
     if (document().isActive())
         document().removedStyleSheet(removedSheet.get());
 }
 
 void ProcessingInstruction::trace(Visitor* visitor)
 {
     visitor->trace(m_sheet);
     CharacterData::trace(visitor);
 }
 
 } // namespace