Adding stylesheet candidates should not crash when the parser reorders the tree

Source/core/dom/TreeScopeStyleSheetCollection.cpp

Index: Source/core/dom/TreeScopeStyleSheetCollection.cpp
diff --git a/Source/core/dom/TreeScopeStyleSheetCollection.cpp b/Source/core/dom/TreeScopeStyleSheetCollection.cpp
index 0c4c24e27cef0f86a4e87a7610a914a73e5ed232..231dd0a03f1b67b0ef8a3a0d5b43abdaf5a96ed7 100644
--- a/Source/core/dom/TreeScopeStyleSheetCollection.cpp
+++ b/Source/core/dom/TreeScopeStyleSheetCollection.cpp
@@ -55,7 +55,7 @@ void TreeScopeStyleSheetCollection::addStyleSheetCandidateNode(Node* node, bool
     // since styles outside of the body and head continue to be shunted into the head
     // (and thus can shift to end up before dynamically added DOM content that is also
     // outside the body).
-    if (createdByParser && document().body())
+    if (createdByParser && document().body() && !node->nextSibling())

[esprehn, 2015/01/10 01:50:44]

I suspect this is wrong if there's mutation events, but I suspect there's no
hope there.

         m_styleSheetCandidateNodes.parserAdd(node);
     else
         m_styleSheetCandidateNodes.add(node);