Reset RestyleFlags when Element is removed.

Source/core/dom/Element.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Peter Kelly (pmk@post.com)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  *           (C) 2007 David Smith (catfish.man@gmail.com)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2012, 2013 Apple Inc. All rights reserved.
  *           (C) 2007 Eric Seidel (eric@webkit.org)
  *
  * This library is free software; you can redistribute it and/or
@@ skipping 1348 matching lines @@
         if (hasPendingResources())
             document().accessSVGExtensions().removeElementFromPendingResources(this);
 
         if (isUpgradedCustomElement())
             CustomElement::didLeaveDocument(this, insertionPoint->document());
     }
 
     document().removeFromTopLayer(this);
 
     clearElementFlag(IsInCanvasSubtree);
+
+    if (hasRareData())
+        elementRareData()->clearRestyleFlags();
 }
 
 void Element::attach(const AttachContext& context)
 {
     ASSERT(document().inStyleRecalc());
 
     // We've already been through detach when doing an attach, but we might
     // need to clear any state that's been added since then.
     if (hasRareData() && styleChangeType() == NeedsReattachStyleChange) {
         ElementRareData* data = elementRareData();
         data->clearComputedStyle();
-        data->clearRestyleFlags();

[esprehn, 2014/05/30 17:46:18]

This doesn't make sense, when you're inserted into the DOM we will always go
through ::attach with a NeedsReattachStyleChagne and reset the flags here. How
did can that get missed?

         // Only clear the style state if we're not going to reuse the style from recalcStyle.
         if (!context.resolvedStyle)
             data->resetStyleState();
     }
 
     RenderTreeBuilder(this, context.resolvedStyle).createRendererForElementIfNeeded();
 
     addCallbackSelectors();
 
     StyleResolverParentScope parentScope(*this);
@@ skipping 25 matching lines @@
     if (needsLayerUpdate())
         document().unscheduleLayerUpdate(*this);
     if (hasRareData()) {
         ElementRareData* data = elementRareData();
         data->clearPseudoElements();
 
         // attach() will perform the below steps for us when inside recalcStyle.
         if (!document().inStyleRecalc()) {
             data->resetStyleState();
             data->clearComputedStyle();
-            data->clearRestyleFlags();

[esprehn, 2014/05/30 17:46:18]

We only execute this line when you remove a child, and only if the element has
not been detached already. What's the code path that is running the
SelectorChecker in ResolveStyle mode on a detached element? That seems like the
real bug.

         }
 
         if (ActiveAnimations* activeAnimations = data->activeAnimations()) {
             if (context.performingReattach) {
                 // FIXME: We call detach from within style recalc, so compositingState is not up to date.
                 // https://code.google.com/p/chromium/issues/detail?id=339847
                 DisableCompositingQueryAsserts disabler;
 
                 // FIXME: restart compositor animations rather than pull back to the main thread
                 activeAnimations->cancelAnimationOnCompositor();
@@ skipping 1864 matching lines @@
 
 void Element::trace(Visitor* visitor)
 {
     if (hasRareData())
         visitor->trace(elementRareData());
 
     ContainerNode::trace(visitor);
 }
 
 } // namespace WebCore