Call insertedInto or removedFrom before childrenChanged

LayoutTests/fast/dom/script-remove-child-id-map.html

Index: LayoutTests/fast/dom/script-remove-child-id-map.html
diff --git a/LayoutTests/fast/dom/script-remove-child-id-map.html b/LayoutTests/fast/dom/script-remove-child-id-map.html
new file mode 100644
index 0000000000000000000000000000000000000000..f7ae63e4c5f0d6b98c67f771c8aab09485875190
--- /dev/null
+++ b/LayoutTests/fast/dom/script-remove-child-id-map.html
@@ -0,0 +1,38 @@
+<p>Passes if it doesn't crash and the child is not in the id map</p>
+<p id="result"></p>
+
+<script>
+function gc()

[adamk, 2014/07/24 21:35:59]

Please include ../../resources/gc.js instead of rolling your own. Or myou could
just use js-test.js and avoid having to do this and the dumpAsText call below.

[esprehn, 2014/07/24 22:50:18]

done.

+{
+    var a = [];
+    for (var i = 0; i < 300000; ++i)
+        a.push("AAAA");
+}
+
+if (window.testRunner)
+    testRunner.dumpAsText();
+
+var script = document.createElement("script");
+script.type = "dont-execute";
+script.textContent = "script.remove()";
+child = document.createElement("div");
+child.id = "child";
+script.appendChild(child);
+
+// The script won't execute here because the type is invalid, but it also won't
+// get marked as being already run, so changing the children later will run it.
+document.documentElement.appendChild(script);
+
+// Per the spec setting the type has no effect
+script.type = "";
+
+// but changing the children *will* execute the script now that the type is
+// is valid.
+child.remove();
+
+child = null;
+gc();
+
+var child = document.getElementById("child");
+document.getElementById("result").textContent = child ? "FAIL" : "PASS";
+</script>