Should clear sheet when ProcessingInstruction's removedFrom or attributeChanged

Source/core/dom/ProcessingInstruction.cpp

 /*
  * Copyright (C) 2000 Peter Kelly (pmk@post.com)
  * Copyright (C) 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
@@ skipping 39 matching lines @@
 
 PassRefPtrWillBeRawPtr<ProcessingInstruction> ProcessingInstruction::create(Document& document, const String& target, const String& data)
 {
     return adoptRefWillBeNoop(new ProcessingInstruction(document, target, data));
 }
 
 ProcessingInstruction::~ProcessingInstruction()
 {
 #if !ENABLE(OILPAN)
     if (m_sheet)
-        m_sheet->clearOwnerNode();
+        clearSheet();
 
     // FIXME: ProcessingInstruction should not be in document here.
     // However, if we add ASSERT(!inDocument()), fast/xsl/xslt-entity.xml
     // crashes. We need to investigate ProcessingInstruction lifetime.
     if (inDocument()) {
         if (m_isCSS)
             document().styleEngine()->removeStyleSheetCandidateNode(this);
         else if (m_isXSL)
             document().styleEngine()->removeXSLStyleSheet(this);
     }
@@ skipping 12 matching lines @@
 
 PassRefPtrWillBeRawPtr<Node> ProcessingInstruction::cloneNode(bool /*deep*/)
 {
     // FIXME: Is it a problem that this does not copy m_localHref?
     // What about other data members?
     return create(document(), m_target, m_data);
 }
 
 void ProcessingInstruction::didAttributeChanged()
 {
-    ASSERT(!m_sheet);
-    ASSERT(!isLoading());
+    if (m_sheet)
+        clearSheet();
+
     String href;
     String charset;
     if (!checkStyleSheet(href, charset))
         return;
     process(href, charset);
 }
 
 bool ProcessingInstruction::checkStyleSheet(String& href, String& charset)
 {
     if (m_target != "xml-stylesheet" || !document().frame() || parentNode() != document())
@@ skipping 99 matching lines @@
     m_sheet = cssSheet.release();
 
     // We don't need the cross-origin security check here because we are
     // getting the sheet text in "strict" mode. This enforces a valid CSS MIME
     // type.
     parseStyleSheet(sheet->sheetText(true));
 }
 
 void ProcessingInstruction::setXSLStyleSheet(const String& href, const KURL& baseURL, const String& sheet)
 {
+    if (!inDocument()) {
+        ASSERT(!m_sheet);
+        return;
+    }
+
     ASSERT(m_isXSL);
     m_sheet = XSLStyleSheet::create(this, href, baseURL);
     parseStyleSheet(sheet);
 }
 
 void ProcessingInstruction::parseStyleSheet(const String& sheet)
 {
     if (m_isCSS)
         toCSSStyleSheet(m_sheet.get())->contents()->parseString(sheet);
     else if (m_isXSL)
@@ skipping 43 matching lines @@
 
     if (m_isCSS)
         document().styleEngine()->removeStyleSheetCandidateNode(this);
     else if (m_isXSL)
         document().styleEngine()->removeXSLStyleSheet(this);
 
     RefPtrWillBeRawPtr<StyleSheet> removedSheet = m_sheet;
 
     if (m_sheet) {
         ASSERT(m_sheet->ownerNode() == this);
-        m_sheet->clearOwnerNode();
-        m_sheet = nullptr;
+        clearSheet();
     }
 
     // If we're in document teardown, then we don't need to do any notification of our sheet's removal.
     if (document().isActive())
         document().removedStyleSheet(removedSheet.get());
 }
 
+void ProcessingInstruction::clearSheet()
+{
+    ASSERT(m_sheet);
+    if (m_sheet->isLoading())
+        document().styleEngine()->removePendingSheet(this);
+    m_sheet.release()->clearOwnerNode();
+}
+
 void ProcessingInstruction::trace(Visitor* visitor)
 {
     visitor->trace(m_sheet);
     CharacterData::trace(visitor);
 }
 
 } // namespace