Protect contextElement during insertAdjacentHTML call

LayoutTests/fast/dom/insertAdjacentHTML-afterend-crash.html

Index: LayoutTests/fast/dom/insertAdjacentHTML-afterend-crash.html
diff --git a/LayoutTests/fast/dom/insertAdjacentHTML-afterend-crash.html b/LayoutTests/fast/dom/insertAdjacentHTML-afterend-crash.html
new file mode 100644
index 0000000000000000000000000000000000000000..3ecbac2666b47dddf8ed862298765e95db574980
--- /dev/null
+++ b/LayoutTests/fast/dom/insertAdjacentHTML-afterend-crash.html
@@ -0,0 +1,16 @@
+This test passes if it doesn't crash (or ASSERT).
+<script>
+if (window.testRunner)
+    testRunner.dumpAsText();
+
+function free() {
+  document.adoptNode(input);
+  gc();
+}
+
+svg = document.createElementNS('http://www.w3.org/2000/svg','mover');
+input = document.createElement('input');
+svg.appendChild(input);
+svg = null;
+input.insertAdjacentHTML('afterend', '<section onload="free()"></section>');
+</script>