Added addXSLStyleSheet and removeXSLStyleSheet to StyleEngine.

Source/core/dom/ProcessingInstruction.cpp

Index: Source/core/dom/ProcessingInstruction.cpp
diff --git a/Source/core/dom/ProcessingInstruction.cpp b/Source/core/dom/ProcessingInstruction.cpp
index 59df65c9773d09395286a316cbb85d838c773867..84d7daf21d201bdbd48cac4d155adfd7bfbeada6 100644
--- a/Source/core/dom/ProcessingInstruction.cpp
+++ b/Source/core/dom/ProcessingInstruction.cpp
@@ -59,8 +59,12 @@ ProcessingInstruction::~ProcessingInstruction()
     if (m_sheet)
         m_sheet->clearOwnerNode();
 
-    if (inDocument())
-        document().styleEngine()->removeStyleSheetCandidateNode(this);
+    if (inDocument()) {

[esprehn, 2014/06/06 01:32:55]

This does doesn't make any sense, you can't be inDocument() if your destructor
is running. I don't understand the old code either.

[tasak, 2014/06/09 04:04:57]

I would like to attach crash log when I added ASSERT(!inDocument()); here:

STDOUT: #CRASHED - renderer (pid 19995)
STDERR: ASSERTION FAILED: !inDocument()
STDERR: ../../third_party/WebKit/Source/core/dom/ProcessingInstruction.cpp(62) :
virtual WebCore::ProcessingInstruction::~ProcessingInstruction()

STDERR: #3 0x000002143103
WebCore::ProcessingInstruction::~ProcessingInstruction()
STDERR: #4 0x000002143279
WebCore::ProcessingInstruction::~ProcessingInstruction()
STDERR: #5 0x000002063835 WebCore::removeDetachedChildrenInContainer<>()
STDERR: #6 0x00000205d7bb WebCore::ContainerNode::removeDetachedChildren()
STDERR: #7 0x00000207665c WebCore::Document::dispose()
STDERR: #8 0x00000207685c WebCore::Document::dispose()
STDERR: #9 0x000002129af4 WebCore::TreeScope::removedLastRefToScope()
STDERR: #10 0x000002125da7 WebCore::Node::removedLastRef()
STDERR: #11 0x000001f90647 WebCore::TreeShared<>::deref()
STDERR: #12 0x000001f9041d WTF::derefIfNotNull<>()
STDERR: #13 0x000001f94238 WTF::RefPtr<>::~RefPtr()
STDERR: #14 0x0000029fa7ae WebCore::XMLHttpRequest::~XMLHttpRequest()
STDERR: #15 0x0000029fa979 WebCore::XMLHttpRequest::~XMLHttpRequest()
STDERR: #16 0x0000029029d3 WTF::RefCounted<>::deref()
STDERR: #17 0x00000310fb63 WebCore::V8XMLHttpRequest::derefObject()
STDERR: #18 0x000002fa3db8 WebCore::releaseObject()
STDERR: #19 0x000002fb4a89 WebCore::ScriptWrappable::setWeakCallback()
STDERR: #20 0x000001b7b172
v8::internal::GlobalHandles::Node::PostGarbageCollectionProcessing()
STDERR: #21 0x000001b7abfc
v8::internal::GlobalHandles::PostGarbageCollectionProcessing()
STDERR: #22 0x000001ba32df v8::internal::Heap::PerformGarbageCollection()
STDERR: #23 0x000001ba274e v8::internal::Heap::CollectGarbage()
STDERR: #24 0x000001ba224e v8::internal::Heap::CollectAllGarbage()

I think, probably ProcessingInstruction and XSLT are not maintained correctly.
So currently, we will see inDocument() in ~ProcessingInstruction.

I added FIXME.

+        if (m_isCSS)
+            document().styleEngine()->removeStyleSheetCandidateNode(this);
+        else if (m_isXSL)
+            document().styleEngine()->removeXSLStyleSheet(this);
+    }
 #endif
 }
 
@@ -242,11 +246,11 @@ Node::InsertionNotificationRequest ProcessingInstruction::insertedInto(Container
 
     String href;
     String charset;
-    // To make it possible for us to see isXSL in
-    // StyleEngine::addStyleSheetCandidateNode, split checkStyleSheet
-    // into two methods, checkStyleSheet and process.
     bool isValid = checkStyleSheet(href, charset);
-    document().styleEngine()->addStyleSheetCandidateNode(this, m_createdByParser);
+    if (m_isCSS)
+        document().styleEngine()->addStyleSheetCandidateNode(this, m_createdByParser);
+    else if (m_isXSL)
+        document().styleEngine()->addXSLStyleSheet(this, m_createdByParser);
     if (isValid)
         process(href, charset);
     return InsertionDone;
@@ -258,7 +262,10 @@ void ProcessingInstruction::removedFrom(ContainerNode* insertionPoint)
     if (!insertionPoint->inDocument())
         return;
 
-    document().styleEngine()->removeStyleSheetCandidateNode(this);
+    if (m_isCSS)
+        document().styleEngine()->removeStyleSheetCandidateNode(this);
+    else if (m_isXSL)
+        document().styleEngine()->removeXSLStyleSheet(this);
 
     RefPtrWillBeRawPtr<StyleSheet> removedSheet = m_sheet;