Reset RestyleFlags when Element is removed.

Source/core/dom/Element.cpp

Index: Source/core/dom/Element.cpp
diff --git a/Source/core/dom/Element.cpp b/Source/core/dom/Element.cpp
index 5d886fa4d6f12b01ebfc27af468349eaa6fbd69b..b790cb88df6e5715a88491bbf44aa7d2d9395b05 100644
--- a/Source/core/dom/Element.cpp
+++ b/Source/core/dom/Element.cpp
@@ -1366,6 +1366,9 @@ void Element::removedFrom(ContainerNode* insertionPoint)
     document().removeFromTopLayer(this);
 
     clearElementFlag(IsInCanvasSubtree);
+
+    if (hasRareData())
+        elementRareData()->clearRestyleFlags();
 }
 
 void Element::attach(const AttachContext& context)
@@ -1377,7 +1380,6 @@ void Element::attach(const AttachContext& context)
     if (hasRareData() && styleChangeType() == NeedsReattachStyleChange) {
         ElementRareData* data = elementRareData();
         data->clearComputedStyle();
-        data->clearRestyleFlags();

[esprehn, 2014/05/30 17:46:18]

This doesn't make sense, when you're inserted into the DOM we will always go
through ::attach with a NeedsReattachStyleChagne and reset the flags here. How
did can that get missed?

         // Only clear the style state if we're not going to reuse the style from recalcStyle.
         if (!context.resolvedStyle)
             data->resetStyleState();
@@ -1423,7 +1425,6 @@ void Element::detach(const AttachContext& context)
         if (!document().inStyleRecalc()) {
             data->resetStyleState();
             data->clearComputedStyle();
-            data->clearRestyleFlags();

[esprehn, 2014/05/30 17:46:18]

We only execute this line when you remove a child, and only if the element has
not been detached already. What's the code path that is running the
SelectorChecker in ResolveStyle mode on a detached element? That seems like the
real bug.

         }
 
         if (ActiveAnimations* activeAnimations = data->activeAnimations()) {