Should clear sheet when ProcessingInstruction's removedFrom or attributeChanged

Source/core/dom/ProcessingInstruction.cpp

Index: Source/core/dom/ProcessingInstruction.cpp
diff --git a/Source/core/dom/ProcessingInstruction.cpp b/Source/core/dom/ProcessingInstruction.cpp
index cfa280d811f4463e34c9cb0c34d7992bab4b8eb5..585454e54fe53b4d59fd27022fa329e107def90e 100644
--- a/Source/core/dom/ProcessingInstruction.cpp
+++ b/Source/core/dom/ProcessingInstruction.cpp
@@ -57,7 +57,7 @@ ProcessingInstruction::~ProcessingInstruction()
 {
 #if !ENABLE(OILPAN)
     if (m_sheet)
-        m_sheet->clearOwnerNode();
+        clearSheet();
 
     // FIXME: ProcessingInstruction should not be in document here.
     // However, if we add ASSERT(!inDocument()), fast/xsl/xslt-entity.xml
@@ -90,8 +90,9 @@ PassRefPtrWillBeRawPtr<Node> ProcessingInstruction::cloneNode(bool /*deep*/)
 
 void ProcessingInstruction::didAttributeChanged()
 {
-    ASSERT(!m_sheet);
-    ASSERT(!isLoading());
+    if (m_sheet)
+        clearSheet();
+
     String href;
     String charset;
     if (!checkStyleSheet(href, charset))
@@ -211,6 +212,11 @@ void ProcessingInstruction::setCSSStyleSheet(const String& href, const KURL& bas
 
 void ProcessingInstruction::setXSLStyleSheet(const String& href, const KURL& baseURL, const String& sheet)
 {
+    if (!inDocument()) {
+        ASSERT(!m_sheet);
+        return;
+    }
+
     ASSERT(m_isXSL);
     m_sheet = XSLStyleSheet::create(this, href, baseURL);
     parseStyleSheet(sheet);
@@ -274,8 +280,7 @@ void ProcessingInstruction::removedFrom(ContainerNode* insertionPoint)
 
     if (m_sheet) {
         ASSERT(m_sheet->ownerNode() == this);
-        m_sheet->clearOwnerNode();
-        m_sheet = nullptr;
+        clearSheet();
     }
 
     // If we're in document teardown, then we don't need to do any notification of our sheet's removal.
@@ -283,6 +288,14 @@ void ProcessingInstruction::removedFrom(ContainerNode* insertionPoint)
         document().removedStyleSheet(removedSheet.get());
 }
 
+void ProcessingInstruction::clearSheet()
+{
+    ASSERT(m_sheet);
+    if (m_sheet->isLoading())
+        document().styleEngine()->removePendingSheet(this);
+    m_sheet.release()->clearOwnerNode();
+}
+
 void ProcessingInstruction::trace(Visitor* visitor)
 {
     visitor->trace(m_sheet);