Detach Event Listener Properties before moving Node.

third_party/WebKit/Source/core/dom/TreeScopeAdopter.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All
  * rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved.
  * (http://www.torchmobile.com/)
  * Copyright (C) 2011 Google Inc. All rights reserved.
@@ skipping 34 matching lines @@
   // increasing the DOMTreeVersion of the donating document here we ensure that
   // the collection cache will be invalidated as needed when the element is
   // moved back.
   Document& oldDocument = oldScope().document();
   Document& newDocument = newScope().document();
   bool willMoveToNewDocument = oldDocument != newDocument;
   if (willMoveToNewDocument)
     oldDocument.incDOMTreeVersion();
 
   for (Node& node : NodeTraversal::inclusiveDescendantsOf(root)) {
+    // Before node.document() changes, allow the node to do pre-move changes.

[bokan, 2017/01/12 16:54:48]

Please add a comment in TreeScopeAdopter::moveNodeToNewDocument that
node.document() may already have been changed and that's why oldDocument is
passed in.

[wjmaclean, 2017/01/13 17:40:30]

Done.

+    if (willMoveToNewDocument)
+      node.willMoveToNewDocument();
+
     updateTreeScope(node);
 
     if (willMoveToNewDocument) {
       moveNodeToNewDocument(node, oldDocument, newDocument);
     } else if (node.hasRareData()) {
       NodeRareData* rareData = node.rareData();
       if (rareData->nodeLists())
         rareData->nodeLists()->adoptTreeScope();
     }
 
@@ skipping 85 matching lines @@
   oldDocumentDidMoveToNewDocumentWasCalledWith = &oldDocument;
 #endif
 
   node.didMoveToNewDocument(oldDocument);
 #if DCHECK_IS_ON()
   DCHECK(didMoveToNewDocumentWasCalled);
 #endif
 }
 
 }  // namespace blink