DOM: adoptNode() should not crash by reparenting the specified node in removeChild().

third_party/WebKit/Source/core/dom/Document.cpp

Index: third_party/WebKit/Source/core/dom/Document.cpp
diff --git a/third_party/WebKit/Source/core/dom/Document.cpp b/third_party/WebKit/Source/core/dom/Document.cpp
index e184fe385333a69833f7ddf0a12bd685793567e7..07e97ae3d3e79475e1d08691a3a2f559e0d92cb5 100644
--- a/third_party/WebKit/Source/core/dom/Document.cpp
+++ b/third_party/WebKit/Source/core/dom/Document.cpp
@@ -1182,7 +1182,16 @@ Node* Document::adoptNode(Node* source, ExceptionState& exceptionState) {
         source->parentNode()->removeChild(source, exceptionState);
         if (exceptionState.hadException())
           return nullptr;
-        CHECK(!source->parentNode());
+        // The above removeChild() can execute arbitrary JavaScript code.
+        if (source->parentNode()) {
+          addConsoleMessage(ConsoleMessage::create(
+              JSMessageSource, WarningMessageLevel,
+              ExceptionMessages::failedToExecute("adoptNode", "Document",
+                                                 "Unable to remove the "
+                                                 "specified node from the "
+                                                 "original parent.")));
+          return nullptr;
+        }
       }
   }