Title: [223685] trunk/Source/WebCore
Revision
223685
Author
[email protected]
Date
2017-10-19 03:05:21 -0700 (Thu, 19 Oct 2017)

Log Message

Add an argument indicating the type of removal to Node::removedFrom
https://bugs.webkit.org/show_bug.cgi?id=178505

Reviewed by Antti Koivisto.

Like r223628, added RemovalType as the first argument to Node::removedFrom, which contains two booleans indicating
whether the node just become disconnected from a document, and whether node's tree scope had changed or not.

These boolean flags simplifies the logic in removedFrom implementations, and are required to have a better
guarantee about the correctness of node flags during calls to removedFrom. Right now, Node::isConnected() and
Node::isInShadowTree() are both outdated until Node::removedFrom is called.

Also renamed the second argument of removedFrom to parentOfRemovedTree to make the semantics clear.

Note that in some implementations of removedFrom, we check whether isConnected() was true to decide whether
the node had already been disconnected from a document prior to calls to this particular call of removedFrom.
This extra check is no longer necessary since no node will be removed from a document without first being inserted
completely somewhere after r223458.

No new tests since there should be no behavioral changes.

* dom/ContainerNodeAlgorithms.cpp:
(WebCore::notifyNodeInsertedIntoDocument): Replaced RELEASE_ASSERT with RELEASE_ASSERT_WITH_SECURITY_IMPLICATION.
(WebCore::notifyNodeRemovedFromDocument): Replaced the check that the node had not been re-connected by scripts
by a release assert now that we believe we've eliminated all causes of these unwanted DOM mutations in r223458.
Also moved the code to call setCSSTarget to Element::removedFrom. This random call to setCSSTarget predates r114351,
as well as r40475. It was originally introduced by r29311 into Node::removedFromDocument() ten years ago.
(WebCore::notifyNodeRemovedFromTree): Moved NoEventDispatchAssertion to notifyChildNodeRemoved.
(WebCore::notifyChildNodeRemoved): Added NoEventDispatchAssertion.
* dom/ContainerNodeAlgorithms.h:
* dom/Element.cpp:
(WebCore::Element::removedFrom): Replaced the complicated code to detect when this element is removed from a document
and its tree scope had changed by removalType.disconnectedFromDocument and removalType.treeScopeChanged.
* dom/Element.h:
* dom/Node.cpp:
(WebCore::Node::removedFrom):
* dom/Node.h: Replaced a long block of comments above insertedInto by two lines of concise comments now that
the semantics of insertedInto and didFinishInsertingNode are more clear, and enforced by assertions.
(WebCore::Node::RemovalType::RemovalType): Addedl
* dom/ProcessingInstruction.cpp:
(WebCore::ProcessingInstruction::removedFrom):
* dom/ProcessingInstruction.h:
* dom/ShadowRoot.cpp:
(WebCore::ShadowRoot::removedFrom): The extra !isConnected() check is no longer needed. See the description above.
* dom/ShadowRoot.h:
* html/FormAssociatedElement.cpp:
(WebCore::FormAssociatedElement::removedFrom):
* html/FormAssociatedElement.h:
* html/HTMLBaseElement.cpp:
(WebCore::HTMLBaseElement::removedFrom):
* html/HTMLBaseElement.h:
* html/HTMLFormControlElement.cpp:
(WebCore::HTMLFormControlElement::removedFrom):
* html/HTMLFormControlElement.h:
* html/HTMLFormControlElementWithState.cpp:
(WebCore::HTMLFormControlElementWithState::removedFrom):
* html/HTMLFormControlElementWithState.h:
* html/HTMLFormElement.cpp:
(WebCore::HTMLFormElement::removedFrom):
* html/HTMLFormElement.h:
* html/HTMLFrameSetElement.cpp:
(WebCore::HTMLFrameSetElement::removedFrom):
* html/HTMLFrameSetElement.h:
* html/HTMLImageElement.cpp:
(WebCore::HTMLImageElement::removedFrom):
* html/HTMLImageElement.h:
* html/HTMLInputElement.cpp:
(WebCore::HTMLInputElement::removedFrom):
* html/HTMLInputElement.h:
* html/HTMLLinkElement.cpp:
(WebCore::HTMLLinkElement::removedFrom): The extra !isConnected() check is no longer needed. See above.
* html/HTMLLinkElement.h:
* html/HTMLMapElement.cpp:
(WebCore::HTMLMapElement::removedFrom):
* html/HTMLMapElement.h:
* html/HTMLMediaElement.cpp:
(WebCore::HTMLMediaElement::removedFrom):
* html/HTMLMediaElement.h:
* html/HTMLObjectElement.cpp:
(WebCore::HTMLObjectElement::removedFrom):
* html/HTMLObjectElement.h:
* html/HTMLSlotElement.cpp:
(WebCore::HTMLSlotElement::removedFrom): Simplifies the logic to detect when this slot element is being
removed from a shadow tree using removalType.treeScopeChanged.
* html/HTMLSlotElement.h:
* html/HTMLSourceElement.cpp:
(WebCore::HTMLSourceElement::insertedInto): Added a FIXME for an obvious bug.
(WebCore::HTMLSourceElement::removedFrom): Ditto.
* html/HTMLSourceElement.h:
* html/HTMLStyleElement.cpp:
(WebCore::HTMLStyleElement::removedFrom):
* html/HTMLStyleElement.h:
* html/HTMLTitleElement.cpp:
(WebCore::HTMLTitleElement::removedFrom):
* html/HTMLTitleElement.h:
* html/HTMLTrackElement.cpp:
(WebCore::HTMLTrackElement::removedFrom): Ditto.
* html/HTMLTrackElement.h:
* svg/SVGElement.cpp:
(WebCore::SVGElement::removedFrom): Replaced isConnected() check before calling Node::removedFrom by the check of
removalType.disconnectedFromDocument.
* svg/SVGElement.h:
* svg/SVGFEImageElement.cpp:
(WebCore::SVGFEImageElement::removedFrom):
* svg/SVGFEImageElement.h:
* svg/SVGFontFaceElement.cpp:
(WebCore::SVGFontFaceElement::removedFrom):
* svg/SVGFontFaceElement.h:
* svg/SVGMPathElement.cpp:
(WebCore::SVGMPathElement::removedFrom):
* svg/SVGMPathElement.h:
* svg/SVGPathElement.cpp:
(WebCore::SVGPathElement::removedFrom):
* svg/SVGPathElement.h:
* svg/SVGSVGElement.cpp:
(WebCore::SVGSVGElement::removedFrom):
* svg/SVGSVGElement.h:
* svg/SVGStyleElement.cpp:
(WebCore::SVGStyleElement::removedFrom): The extra !isConnected() check is no longer needed. See above.
* svg/SVGStyleElement.h:
* svg/SVGTRefElement.cpp:
(WebCore::SVGTRefElement::removedFrom):
* svg/SVGTRefElement.h:
* svg/SVGTextPathElement.cpp:
(WebCore::SVGTextPathElement::removedFrom):
* svg/SVGTextPathElement.h:
* svg/SVGTitleElement.cpp:
(WebCore::SVGTitleElement::removedFrom):
* svg/SVGTitleElement.h:
* svg/SVGUseElement.cpp:
(WebCore::SVGUseElement::removedFrom):
* svg/SVGUseElement.h:
* svg/animation/SVGSMILElement.cpp:
(WebCore::SVGSMILElement::removedFrom):
* svg/animation/SVGSMILElement.h:

Modified Paths

Diff

Modified: trunk/Source/WebCore/ChangeLog (223684 => 223685)


--- trunk/Source/WebCore/ChangeLog	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/ChangeLog	2017-10-19 10:05:21 UTC (rev 223685)
@@ -1,3 +1,141 @@
+2017-10-19  Ryosuke Niwa  <[email protected]>
+
+        Add an argument indicating the type of removal to Node::removedFrom
+        https://bugs.webkit.org/show_bug.cgi?id=178505
+
+        Reviewed by Antti Koivisto.
+
+        Like r223628, added RemovalType as the first argument to Node::removedFrom, which contains two booleans indicating
+        whether the node just become disconnected from a document, and whether node's tree scope had changed or not.
+
+        These boolean flags simplifies the logic in removedFrom implementations, and are required to have a better
+        guarantee about the correctness of node flags during calls to removedFrom. Right now, Node::isConnected() and
+        Node::isInShadowTree() are both outdated until Node::removedFrom is called.
+
+        Also renamed the second argument of removedFrom to parentOfRemovedTree to make the semantics clear.
+
+        Note that in some implementations of removedFrom, we check whether isConnected() was true to decide whether
+        the node had already been disconnected from a document prior to calls to this particular call of removedFrom.
+        This extra check is no longer necessary since no node will be removed from a document without first being inserted
+        completely somewhere after r223458.
+
+        No new tests since there should be no behavioral changes.
+
+        * dom/ContainerNodeAlgorithms.cpp:
+        (WebCore::notifyNodeInsertedIntoDocument): Replaced RELEASE_ASSERT with RELEASE_ASSERT_WITH_SECURITY_IMPLICATION.
+        (WebCore::notifyNodeRemovedFromDocument): Replaced the check that the node had not been re-connected by scripts
+        by a release assert now that we believe we've eliminated all causes of these unwanted DOM mutations in r223458.
+        Also moved the code to call setCSSTarget to Element::removedFrom. This random call to setCSSTarget predates r114351,
+        as well as r40475. It was originally introduced by r29311 into Node::removedFromDocument() ten years ago.
+        (WebCore::notifyNodeRemovedFromTree): Moved NoEventDispatchAssertion to notifyChildNodeRemoved.
+        (WebCore::notifyChildNodeRemoved): Added NoEventDispatchAssertion.
+        * dom/ContainerNodeAlgorithms.h:
+        * dom/Element.cpp:
+        (WebCore::Element::removedFrom): Replaced the complicated code to detect when this element is removed from a document
+        and its tree scope had changed by removalType.disconnectedFromDocument and removalType.treeScopeChanged.
+        * dom/Element.h:
+        * dom/Node.cpp:
+        (WebCore::Node::removedFrom):
+        * dom/Node.h: Replaced a long block of comments above insertedInto by two lines of concise comments now that
+        the semantics of insertedInto and didFinishInsertingNode are more clear, and enforced by assertions.
+        (WebCore::Node::RemovalType::RemovalType): Addedl
+        * dom/ProcessingInstruction.cpp:
+        (WebCore::ProcessingInstruction::removedFrom):
+        * dom/ProcessingInstruction.h:
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::removedFrom): The extra !isConnected() check is no longer needed. See the description above.
+        * dom/ShadowRoot.h:
+        * html/FormAssociatedElement.cpp:
+        (WebCore::FormAssociatedElement::removedFrom):
+        * html/FormAssociatedElement.h:
+        * html/HTMLBaseElement.cpp:
+        (WebCore::HTMLBaseElement::removedFrom):
+        * html/HTMLBaseElement.h:
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::removedFrom):
+        * html/HTMLFormControlElement.h:
+        * html/HTMLFormControlElementWithState.cpp:
+        (WebCore::HTMLFormControlElementWithState::removedFrom):
+        * html/HTMLFormControlElementWithState.h:
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::removedFrom):
+        * html/HTMLFormElement.h:
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::removedFrom):
+        * html/HTMLFrameSetElement.h:
+        * html/HTMLImageElement.cpp:
+        (WebCore::HTMLImageElement::removedFrom):
+        * html/HTMLImageElement.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::removedFrom):
+        * html/HTMLInputElement.h:
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::removedFrom): The extra !isConnected() check is no longer needed. See above.
+        * html/HTMLLinkElement.h:
+        * html/HTMLMapElement.cpp:
+        (WebCore::HTMLMapElement::removedFrom):
+        * html/HTMLMapElement.h:
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::removedFrom):
+        * html/HTMLMediaElement.h:
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::removedFrom):
+        * html/HTMLObjectElement.h:
+        * html/HTMLSlotElement.cpp:
+        (WebCore::HTMLSlotElement::removedFrom): Simplifies the logic to detect when this slot element is being
+        removed from a shadow tree using removalType.treeScopeChanged.
+        * html/HTMLSlotElement.h:
+        * html/HTMLSourceElement.cpp:
+        (WebCore::HTMLSourceElement::insertedInto): Added a FIXME for an obvious bug.
+        (WebCore::HTMLSourceElement::removedFrom): Ditto.
+        * html/HTMLSourceElement.h:
+        * html/HTMLStyleElement.cpp:
+        (WebCore::HTMLStyleElement::removedFrom):
+        * html/HTMLStyleElement.h:
+        * html/HTMLTitleElement.cpp:
+        (WebCore::HTMLTitleElement::removedFrom):
+        * html/HTMLTitleElement.h:
+        * html/HTMLTrackElement.cpp:
+        (WebCore::HTMLTrackElement::removedFrom): Ditto.
+        * html/HTMLTrackElement.h:
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::removedFrom): Replaced isConnected() check before calling Node::removedFrom by the check of
+        removalType.disconnectedFromDocument.
+        * svg/SVGElement.h:
+        * svg/SVGFEImageElement.cpp:
+        (WebCore::SVGFEImageElement::removedFrom):
+        * svg/SVGFEImageElement.h:
+        * svg/SVGFontFaceElement.cpp:
+        (WebCore::SVGFontFaceElement::removedFrom):
+        * svg/SVGFontFaceElement.h:
+        * svg/SVGMPathElement.cpp:
+        (WebCore::SVGMPathElement::removedFrom):
+        * svg/SVGMPathElement.h:
+        * svg/SVGPathElement.cpp:
+        (WebCore::SVGPathElement::removedFrom):
+        * svg/SVGPathElement.h:
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::removedFrom):
+        * svg/SVGSVGElement.h:
+        * svg/SVGStyleElement.cpp:
+        (WebCore::SVGStyleElement::removedFrom): The extra !isConnected() check is no longer needed. See above.
+        * svg/SVGStyleElement.h:
+        * svg/SVGTRefElement.cpp:
+        (WebCore::SVGTRefElement::removedFrom):
+        * svg/SVGTRefElement.h:
+        * svg/SVGTextPathElement.cpp:
+        (WebCore::SVGTextPathElement::removedFrom):
+        * svg/SVGTextPathElement.h:
+        * svg/SVGTitleElement.cpp:
+        (WebCore::SVGTitleElement::removedFrom):
+        * svg/SVGTitleElement.h:
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::removedFrom):
+        * svg/SVGUseElement.h:
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::SVGSMILElement::removedFrom):
+        * svg/animation/SVGSMILElement.h:
+
 2017-10-19  Ms2ger  <[email protected]>
 
         Update the signatures of compressedTexSubImage3D.

Modified: trunk/Source/WebCore/dom/ContainerNodeAlgorithms.cpp (223684 => 223685)


--- trunk/Source/WebCore/dom/ContainerNodeAlgorithms.cpp	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/dom/ContainerNodeAlgorithms.cpp	2017-10-19 10:05:21 UTC (rev 223685)
@@ -48,7 +48,7 @@
         return;
 
     for (RefPtr<Node> child = downcast<ContainerNode>(node).firstChild(); child; child = child->nextSibling()) {
-        RELEASE_ASSERT(node.isConnected() && child->parentNode() == &node);
+        RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(node.isConnected() && child->parentNode() == &node);
         notifyNodeInsertedIntoDocument(parentOfInsertedTree, *child, treeScopeChange, postInsertionNotificationTargets);
     }
 
@@ -56,7 +56,7 @@
         return;
 
     if (RefPtr<ShadowRoot> root = downcast<Element>(node).shadowRoot()) {
-        RELEASE_ASSERT(node.isConnected() && root->host() == &node);
+        RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(node.isConnected() && root->host() == &node);
         notifyNodeInsertedIntoDocument(parentOfInsertedTree, *root, TreeScopeChange::DidNotChange, postInsertionNotificationTargets);
     }
 }
@@ -103,58 +103,58 @@
     return postInsertionNotificationTargets;
 }
 
-static void notifyNodeRemovedFromDocument(ContainerNode& insertionPoint, Node& node)
+static void notifyNodeRemovedFromDocument(ContainerNode& parentOfRemovedTree, TreeScopeChange treeScopeChange, Node& node)
 {
-    ASSERT(insertionPoint.isConnected());
-    node.removedFrom(insertionPoint);
+    ASSERT(parentOfRemovedTree.isConnected());
+    ASSERT(node.isConnected());
+    node.removedFrom(Node::RemovalType { /* disconnectedFromDocument */ true, treeScopeChange == TreeScopeChange::Changed }, parentOfRemovedTree);
 
     if (!is<ContainerNode>(node))
         return;
 
-    ChildNodesLazySnapshot snapshot(downcast<ContainerNode>(node));
-    while (RefPtr<Node> child = snapshot.nextNode()) {
-        // If we have been added to the document during this loop, then we
-        // don't want to tell the rest of our children that they've been
-        // removed from the document because they haven't.
-        if (!node.isConnected() && child->parentNode() == &node)
-            notifyNodeRemovedFromDocument(insertionPoint, *child.get());
+    for (RefPtr<Node> child = downcast<ContainerNode>(node).firstChild(); child; child = child->nextSibling()) {
+        RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(!node.isConnected() && child->parentNode() == &node);
+        notifyNodeRemovedFromDocument(parentOfRemovedTree, treeScopeChange, *child.get());
     }
 
     if (!is<Element>(node))
         return;
 
-    if (node.document().cssTarget() == &node)
-        node.document().setCSSTarget(nullptr);
-
     if (RefPtr<ShadowRoot> root = downcast<Element>(node).shadowRoot()) {
-        if (!node.isConnected() && root->host() == &node)
-            notifyNodeRemovedFromDocument(insertionPoint, *root.get());
+        RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(!node.isConnected() && root->host() == &node);
+        notifyNodeRemovedFromDocument(parentOfRemovedTree, TreeScopeChange::DidNotChange, *root.get());
     }
 }
 
-static void notifyNodeRemovedFromTree(ContainerNode& insertionPoint, Node& node)
+static void notifyNodeRemovedFromTree(ContainerNode& parentOfRemovedTree, TreeScopeChange treeScopeChange, Node& node)
 {
-    NoEventDispatchAssertion assertNoEventDispatch;
-    ASSERT(!insertionPoint.isConnected());
+    ASSERT(!parentOfRemovedTree.isConnected());
 
-    node.removedFrom(insertionPoint);
+    node.removedFrom(Node::RemovalType { /* disconnectedFromDocument */ false, treeScopeChange == TreeScopeChange::Changed }, parentOfRemovedTree);
 
-    for (Node* child = node.firstChild(); child; child = child->nextSibling())
-        notifyNodeRemovedFromTree(insertionPoint, *child);
+    if (!is<ContainerNode>(node))
+        return;
 
+    for (RefPtr<Node> child = downcast<ContainerNode>(node).firstChild(); child; child = child->nextSibling())
+        notifyNodeRemovedFromTree(parentOfRemovedTree, treeScopeChange, *child);
+
     if (!is<Element>(node))
         return;
 
     if (RefPtr<ShadowRoot> root = downcast<Element>(node).shadowRoot())
-        notifyNodeRemovedFromTree(insertionPoint, *root);
+        notifyNodeRemovedFromTree(parentOfRemovedTree, TreeScopeChange::DidNotChange, *root);
 }
 
-void notifyChildNodeRemoved(ContainerNode& insertionPoint, Node& child)
+void notifyChildNodeRemoved(ContainerNode& parentOfRemovedTree, Node& child)
 {
+    NoEventDispatchAssertion assertNoEventDispatch;
+
+    // Tree scope has changed if the container node from which "node" is removed is in a document or a shadow root.
+    auto treeScopeChange = parentOfRemovedTree.isInTreeScope() ? TreeScopeChange::Changed : TreeScopeChange::DidNotChange;
     if (child.isConnected())
-        notifyNodeRemovedFromDocument(insertionPoint, child);
+        notifyNodeRemovedFromDocument(parentOfRemovedTree, treeScopeChange, child);
     else
-        notifyNodeRemovedFromTree(insertionPoint, child);
+        notifyNodeRemovedFromTree(parentOfRemovedTree, treeScopeChange, child);
 }
 
 void addChildNodesToDeletionQueue(Node*& head, Node*& tail, ContainerNode& container)

Modified: trunk/Source/WebCore/dom/ContainerNodeAlgorithms.h (223684 => 223685)


--- trunk/Source/WebCore/dom/ContainerNodeAlgorithms.h	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/dom/ContainerNodeAlgorithms.h	2017-10-19 10:05:21 UTC (rev 223685)
@@ -27,7 +27,7 @@
 namespace WebCore {
 
 NodeVector notifyChildNodeInserted(ContainerNode& parentOfInsertedTree, Node&);
-void notifyChildNodeRemoved(ContainerNode& insertionPoint, Node&);
+void notifyChildNodeRemoved(ContainerNode& parentOfRemovedTree, Node&);
 void removeDetachedChildrenInContainer(ContainerNode&);
 
 enum SubframeDisconnectPolicy {

Modified: trunk/Source/WebCore/dom/Element.cpp (223684 => 223685)


--- trunk/Source/WebCore/dom/Element.cpp	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/dom/Element.cpp	2017-10-19 10:05:21 UTC (rev 223685)
@@ -1683,7 +1683,7 @@
     return InsertedIntoResult::Done;
 }
 
-void Element::removedFrom(ContainerNode& insertionPoint)
+void Element::removedFrom(RemovalType removalType, ContainerNode& parentOfRemovedTree)
 {
 #if ENABLE(FULLSCREEN_API)
     if (containsFullScreenElement())
@@ -1696,14 +1696,11 @@
 
     setSavedLayerScrollPosition(ScrollPosition());
 
-    if (insertionPoint.isInTreeScope()) {
-        TreeScope* oldScope = &insertionPoint.treeScope();
-        bool becomeDisconnected = isConnected();
-        HTMLDocument* oldDocument = becomeDisconnected && is<HTMLDocument>(oldScope->documentScope()) ? &downcast<HTMLDocument>(oldScope->documentScope()) : nullptr;
-
-        // ContainerNode::removeBetween always sets the removed chid's tree scope to Document's but InTreeScope flag is unset in Node::removedFrom.
-        // So this element has been removed from the old tree scope only if InTreeScope flag is set and this element's tree scope is Document's.
-        if (!isInTreeScope() || &treeScope() != &document())
+    if (parentOfRemovedTree.isInTreeScope()) {
+        TreeScope* oldScope = &parentOfRemovedTree.treeScope();
+        Document* oldDocument = removalType.disconnectedFromDocument ? &oldScope->documentScope() : nullptr;
+        HTMLDocument* oldHTMLDocument = oldDocument && is<HTMLDocument>(*oldDocument) ? &downcast<HTMLDocument>(*oldDocument) : nullptr;
+        if (!removalType.treeScopeChanged)
             oldScope = nullptr;
 
         const AtomicString& idValue = getIdAttribute();
@@ -1710,8 +1707,8 @@
         if (!idValue.isNull()) {
             if (oldScope)
                 updateIdForTreeScope(*oldScope, idValue, nullAtom());
-            if (oldDocument)
-                updateIdForDocument(*oldDocument, idValue, nullAtom(), AlwaysUpdateHTMLDocumentNamedItemMaps);
+            if (oldHTMLDocument)
+                updateIdForDocument(*oldHTMLDocument, idValue, nullAtom(), AlwaysUpdateHTMLDocumentNamedItemMaps);
         }
 
         const AtomicString& nameValue = getNameAttribute();
@@ -1718,8 +1715,8 @@
         if (!nameValue.isNull()) {
             if (oldScope)
                 updateNameForTreeScope(*oldScope, nameValue, nullAtom());
-            if (oldDocument)
-                updateNameForDocument(*oldDocument, nameValue, nullAtom());
+            if (oldHTMLDocument)
+                updateNameForDocument(*oldHTMLDocument, nameValue, nullAtom());
         }
 
         if (oldScope && hasTagName(labelTag)) {
@@ -1727,16 +1724,21 @@
                 updateLabel(*oldScope, attributeWithoutSynchronization(forAttr), nullAtom());
         }
 
-        if (becomeDisconnected && UNLIKELY(isDefinedCustomElement()))
+        if (oldDocument) {
+            if (oldDocument->cssTarget() == this)
+                oldDocument->setCSSTarget(nullptr);
+        }
+
+        if (removalType.disconnectedFromDocument && UNLIKELY(isDefinedCustomElement()))
             CustomElementReactionQueue::enqueueDisconnectedCallbackIfNeeded(*this);
     }
 
     if (!parentNode()) {
-        if (auto* shadowRoot = insertionPoint.shadowRoot())
+        if (auto* shadowRoot = parentOfRemovedTree.shadowRoot())
             shadowRoot->hostChildElementDidChange(*this);
     }
 
-    ContainerNode::removedFrom(insertionPoint);
+    ContainerNode::removedFrom(removalType, parentOfRemovedTree);
 
     if (hasPendingResources())
         document().accessSVGExtensions().removeElementFromPendingResources(this);

Modified: trunk/Source/WebCore/dom/Element.h (223684 => 223685)


--- trunk/Source/WebCore/dom/Element.h	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/dom/Element.h	2017-10-19 10:05:21 UTC (rev 223685)
@@ -552,7 +552,7 @@
     Element(const QualifiedName&, Document&, ConstructionType);
 
     InsertedIntoResult insertedInto(InsertionType, ContainerNode&) override;
-    void removedFrom(ContainerNode&) override;
+    void removedFrom(RemovalType, ContainerNode&) override;
     void childrenChanged(const ChildChange&) override;
     void removeAllEventListeners() final;
     virtual void parserDidSetAttributes();

Modified: trunk/Source/WebCore/dom/Node.cpp (223684 => 223685)


--- trunk/Source/WebCore/dom/Node.cpp	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/dom/Node.cpp	2017-10-19 10:05:21 UTC (rev 223685)
@@ -1253,9 +1253,9 @@
     return InsertedIntoResult::Done;
 }
 
-void Node::removedFrom(ContainerNode& insertionPoint)
+void Node::removedFrom(RemovalType removalType, ContainerNode&)
 {
-    if (insertionPoint.isConnected())
+    if (removalType.disconnectedFromDocument)
         clearFlag(IsConnectedFlag);
     if (isInShadowTree() && !treeScope().rootNode().isShadowRoot())
         clearFlag(IsInShadowTreeFlag);

Modified: trunk/Source/WebCore/dom/Node.h (223684 => 223685)


--- trunk/Source/WebCore/dom/Node.h	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/dom/Node.h	2017-10-19 10:05:21 UTC (rev 223685)
@@ -433,21 +433,6 @@
 
     virtual const RenderStyle* computedStyle(PseudoId pseudoElementSpecifier = NOPSEUDO);
 
-    // -----------------------------------------------------------------------------
-    // Notification of document structure changes (see ContainerNode.h for more notification methods)
-    //
-    // At first, WebKit notifies the node that it has been inserted into the document. This is called during document parsing, and also
-    // when a node is added through the DOM methods insertBefore(), appendChild() or replaceChild(). The call happens _after_ the node has been added to the tree.
-    // This is similar to the DOMNodeInsertedIntoDocument DOM event, but does not require the overhead of event
-    // dispatching.
-    //
-    // WebKit notifies this callback regardless if the subtree of the node is a document tree or a floating subtree.
-    // Implementation can determine the type of subtree by seeing insertionPoint->isConnected().
-    //
-    // There is another callback named didFinishInsertingNode(), which is called after all descendants are notified.
-    // Only a few subclasses actually need this. To utilize this, the node should return InsertedIntoResult::NeedsPostInsertionCallback
-    // from insrtedInto().
-    //
     enum class InsertedIntoResult {
         Done,
         NeedsPostInsertionCallback,
@@ -463,15 +448,22 @@
         bool connectedToDocument { false };
         bool treeScopeChanged { false };
     };
+    // Called *after* this node or its ancestor is inserted into a new parent (may or may not be a part of document) by scripts or parser.
+    // insertedInto **MUST NOT** invoke scripts. Return NeedsPostInsertionCallback and implement didFinishInsertingNode instead to run scripts.
     virtual InsertedIntoResult insertedInto(InsertionType, ContainerNode& parentOfInsertedTree);
     virtual void didFinishInsertingNode() { }
 
-    // Notifies the node that it is no longer part of the tree.
-    //
-    // This is a dual of insertedInto(), and is similar to the DOMNodeRemovedFromDocument DOM event, but does not require the overhead of event
-    // dispatching, and is called _after_ the node is removed from the tree.
-    //
-    virtual void removedFrom(ContainerNode& insertionPoint);
+    struct RemovalType {
+#if !COMPILER_SUPPORTS(NSDMI_FOR_AGGREGATES)
+        RemovalType(bool disconnectedFromDocument, bool treeScopeChanged)
+            : disconnectedFromDocument(disconnectedFromDocument)
+            , treeScopeChanged(treeScopeChanged)
+        { }
+#endif
+        bool disconnectedFromDocument { false };
+        bool treeScopeChanged { false };
+    };
+    virtual void removedFrom(RemovalType, ContainerNode& parentOfRemovedTree);
 
 #if ENABLE(TREE_DEBUGGING)
     virtual void formatForDebugger(char* buffer, unsigned length) const;

Modified: trunk/Source/WebCore/dom/ProcessingInstruction.cpp (223684 => 223685)


--- trunk/Source/WebCore/dom/ProcessingInstruction.cpp	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/dom/ProcessingInstruction.cpp	2017-10-19 10:05:21 UTC (rev 223685)
@@ -288,10 +288,10 @@
     checkStyleSheet();
 }
 
-void ProcessingInstruction::removedFrom(ContainerNode& insertionPoint)
+void ProcessingInstruction::removedFrom(RemovalType removalType, ContainerNode& parentOfRemovedTree)
 {
-    CharacterData::removedFrom(insertionPoint);
-    if (!insertionPoint.isConnected())
+    CharacterData::removedFrom(removalType, parentOfRemovedTree);
+    if (!removalType.disconnectedFromDocument)
         return;
     
     document().styleScope().removeStyleSheetCandidateNode(*this);

Modified: trunk/Source/WebCore/dom/ProcessingInstruction.h (223684 => 223685)


--- trunk/Source/WebCore/dom/ProcessingInstruction.h	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/dom/ProcessingInstruction.h	2017-10-19 10:05:21 UTC (rev 223685)
@@ -60,7 +60,7 @@
 
     InsertedIntoResult insertedInto(InsertionType, ContainerNode&) override;
     void didFinishInsertingNode() override;
-    void removedFrom(ContainerNode&) override;
+    void removedFrom(RemovalType, ContainerNode&) override;
 
     void checkStyleSheet();
     void setCSSStyleSheet(const String& href, const URL& baseURL, const String& charset, const CachedCSSStyleSheet*) override;

Modified: trunk/Source/WebCore/dom/ShadowRoot.cpp (223684 => 223685)


--- trunk/Source/WebCore/dom/ShadowRoot.cpp	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/dom/ShadowRoot.cpp	2017-10-19 10:05:21 UTC (rev 223685)
@@ -93,10 +93,10 @@
     return InsertedIntoResult::Done;
 }
 
-void ShadowRoot::removedFrom(ContainerNode& insertionPoint)
+void ShadowRoot::removedFrom(RemovalType removalType, ContainerNode& parentOfRemovedTree)
 {
-    DocumentFragment::removedFrom(insertionPoint);
-    if (insertionPoint.isConnected() && !isConnected())
+    DocumentFragment::removedFrom(removalType, parentOfRemovedTree);
+    if (removalType.disconnectedFromDocument)
         document().didRemoveInDocumentShadowRoot(*this);
 }
 

Modified: trunk/Source/WebCore/dom/ShadowRoot.h (223684 => 223685)


--- trunk/Source/WebCore/dom/ShadowRoot.h	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/dom/ShadowRoot.h	2017-10-19 10:05:21 UTC (rev 223685)
@@ -95,7 +95,7 @@
     Ref<Node> cloneNodeInternal(Document&, CloningOperation) override;
 
     Node::InsertedIntoResult insertedInto(InsertionType, ContainerNode&) override;
-    void removedFrom(ContainerNode& insertionPoint) override;
+    void removedFrom(RemovalType, ContainerNode& insertionPoint) override;
     void didMoveToNewDocument(Document& oldDocument, Document& newDocument) override;
 
     bool m_resetStyleInheritance { false };

Modified: trunk/Source/WebCore/html/FormAssociatedElement.cpp (223684 => 223685)


--- trunk/Source/WebCore/html/FormAssociatedElement.cpp	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/html/FormAssociatedElement.cpp	2017-10-19 10:05:21 UTC (rev 223685)
@@ -88,7 +88,7 @@
         resetFormAttributeTargetObserver();
 }
 
-void FormAssociatedElement::removedFrom(ContainerNode&)
+void FormAssociatedElement::removedFrom(Node::RemovalType, ContainerNode&)
 {
     m_formAttributeTargetObserver = nullptr;
 

Modified: trunk/Source/WebCore/html/FormAssociatedElement.h (223684 => 223685)


--- trunk/Source/WebCore/html/FormAssociatedElement.h	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/html/FormAssociatedElement.h	2017-10-19 10:05:21 UTC (rev 223685)
@@ -91,7 +91,7 @@
     FormAssociatedElement(HTMLFormElement*);
 
     void insertedInto(Node::InsertionType, ContainerNode&);
-    void removedFrom(ContainerNode&);
+    void removedFrom(Node::RemovalType, ContainerNode&);
     void didMoveToNewDocument(Document& oldDocument);
 
     void setForm(HTMLFormElement*);

Modified: trunk/Source/WebCore/html/HTMLBaseElement.cpp (223684 => 223685)


--- trunk/Source/WebCore/html/HTMLBaseElement.cpp	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/html/HTMLBaseElement.cpp	2017-10-19 10:05:21 UTC (rev 223685)
@@ -59,10 +59,10 @@
     return InsertedIntoResult::Done;
 }
 
-void HTMLBaseElement::removedFrom(ContainerNode& insertionPoint)
+void HTMLBaseElement::removedFrom(RemovalType removalType, ContainerNode& parentOfRemovedTree)
 {
-    HTMLElement::removedFrom(insertionPoint);
-    if (insertionPoint.isConnected())
+    HTMLElement::removedFrom(removalType, parentOfRemovedTree);
+    if (removalType.disconnectedFromDocument)
         document().processBaseElement();
 }
 

Modified: trunk/Source/WebCore/html/HTMLBaseElement.h (223684 => 223685)


--- trunk/Source/WebCore/html/HTMLBaseElement.h	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/html/HTMLBaseElement.h	2017-10-19 10:05:21 UTC (rev 223685)
@@ -40,7 +40,7 @@
     bool isURLAttribute(const Attribute&) const final;
     void parseAttribute(const QualifiedName&, const AtomicString&) final;
     InsertedIntoResult insertedInto(InsertionType, ContainerNode&) final;
-    void removedFrom(ContainerNode&) final;
+    void removedFrom(RemovalType, ContainerNode&) final;
 };
 
 } // namespace

Modified: trunk/Source/WebCore/html/HTMLFormControlElement.cpp (223684 => 223685)


--- trunk/Source/WebCore/html/HTMLFormControlElement.cpp	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/html/HTMLFormControlElement.cpp	2017-10-19 10:05:21 UTC (rev 223685)
@@ -292,7 +292,7 @@
     resetFormOwner();
 }
 
-void HTMLFormControlElement::removedFrom(ContainerNode& insertionPoint)
+void HTMLFormControlElement::removedFrom(RemovalType removalType, ContainerNode& parentOfRemovedTree)
 {
     bool wasMatchingInvalidPseudoClass = willValidate() && !isValidFormControlElement();
 
@@ -300,11 +300,11 @@
     if (m_disabledByAncestorFieldset)
         setAncestorDisabled(computeIsDisabledByFieldsetAncestor());
     m_dataListAncestorState = Unknown;
-    HTMLElement::removedFrom(insertionPoint);
-    FormAssociatedElement::removedFrom(insertionPoint);
+    HTMLElement::removedFrom(removalType, parentOfRemovedTree);
+    FormAssociatedElement::removedFrom(removalType, parentOfRemovedTree);
 
     if (wasMatchingInvalidPseudoClass)
-        removeInvalidElementToAncestorFromInsertionPoint(*this, &insertionPoint);
+        removeInvalidElementToAncestorFromInsertionPoint(*this, &parentOfRemovedTree);
 }
 
 void HTMLFormControlElement::setChangedSinceLastFormControlChangeEvent(bool changed)

Modified: trunk/Source/WebCore/html/HTMLFormControlElement.h (223684 => 223685)


--- trunk/Source/WebCore/html/HTMLFormControlElement.h	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/html/HTMLFormControlElement.h	2017-10-19 10:05:21 UTC (rev 223685)
@@ -138,7 +138,7 @@
     void didAttachRenderers() override;
     InsertedIntoResult insertedInto(InsertionType, ContainerNode&) override;
     void didFinishInsertingNode() override;
-    void removedFrom(ContainerNode&) override;
+    void removedFrom(RemovalType, ContainerNode&) override;
     void didMoveToNewDocument(Document& oldDocument, Document& newDocument) override;
 
     bool supportsFocus() const override;

Modified: trunk/Source/WebCore/html/HTMLFormControlElementWithState.cpp (223684 => 223685)


--- trunk/Source/WebCore/html/HTMLFormControlElementWithState.cpp	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/html/HTMLFormControlElementWithState.cpp	2017-10-19 10:05:21 UTC (rev 223685)
@@ -47,11 +47,11 @@
     return HTMLFormControlElement::insertedInto(insertionType, parentOfInsertedTree);
 }
 
-void HTMLFormControlElementWithState::removedFrom(ContainerNode& insertionPoint)
+void HTMLFormControlElementWithState::removedFrom(RemovalType removalType, ContainerNode& parentOfRemovedTree)
 {
-    if (insertionPoint.isConnected() && !containingShadowRoot() && !insertionPoint.containingShadowRoot())
+    if (removalType.disconnectedFromDocument && !containingShadowRoot() && !parentOfRemovedTree.containingShadowRoot())
         document().formController().unregisterFormElementWithState(this);
-    HTMLFormControlElement::removedFrom(insertionPoint);
+    HTMLFormControlElement::removedFrom(removalType, parentOfRemovedTree);
 }
 
 bool HTMLFormControlElementWithState::shouldAutocomplete() const

Modified: trunk/Source/WebCore/html/HTMLFormControlElementWithState.h (223684 => 223685)


--- trunk/Source/WebCore/html/HTMLFormControlElementWithState.h	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/html/HTMLFormControlElementWithState.h	2017-10-19 10:05:21 UTC (rev 223685)
@@ -46,7 +46,7 @@
     virtual bool shouldAutocomplete() const;
     void finishParsingChildren() override;
     InsertedIntoResult insertedInto(InsertionType, ContainerNode&) override;
-    void removedFrom(ContainerNode&) override;
+    void removedFrom(RemovalType, ContainerNode&) override;
     bool isFormControlElementWithState() const override;
 };
 

Modified: trunk/Source/WebCore/html/HTMLFormElement.cpp (223684 => 223685)


--- trunk/Source/WebCore/html/HTMLFormElement.cpp	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/html/HTMLFormElement.cpp	2017-10-19 10:05:21 UTC (rev 223685)
@@ -129,13 +129,13 @@
     return InsertedIntoResult::Done;
 }
 
-void HTMLFormElement::removedFrom(ContainerNode& insertionPoint)
+void HTMLFormElement::removedFrom(RemovalType removalType, ContainerNode& parentOfRemovedTree)
 {
     Node& root = traverseToRootNode(); // Do not rely on rootNode() because our IsInTreeScope is outdated.
     Vector<FormAssociatedElement*> associatedElements(m_associatedElements);
     for (auto& associatedElement : associatedElements)
         associatedElement->formOwnerRemovedFromTree(root);
-    HTMLElement::removedFrom(insertionPoint);
+    HTMLElement::removedFrom(removalType, parentOfRemovedTree);
 }
 
 void HTMLFormElement::handleLocalEvents(Event& event)

Modified: trunk/Source/WebCore/html/HTMLFormElement.h (223684 => 223685)


--- trunk/Source/WebCore/html/HTMLFormElement.h	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/html/HTMLFormElement.h	2017-10-19 10:05:21 UTC (rev 223685)
@@ -125,7 +125,7 @@
 
     bool rendererIsNeeded(const RenderStyle&) final;
     InsertedIntoResult insertedInto(InsertionType, ContainerNode&) final;
-    void removedFrom(ContainerNode&) final;
+    void removedFrom(RemovalType, ContainerNode&) final;
     void finishParsingChildren() final;
 
     void handleLocalEvents(Event&) final;

Modified: trunk/Source/WebCore/html/HTMLFrameSetElement.cpp (223684 => 223685)


--- trunk/Source/WebCore/html/HTMLFrameSetElement.cpp	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/html/HTMLFrameSetElement.cpp	2017-10-19 10:05:21 UTC (rev 223685)
@@ -219,10 +219,10 @@
     return InsertedIntoResult::Done;
 }
 
-void HTMLFrameSetElement::removedFrom(ContainerNode& insertionPoint)
+void HTMLFrameSetElement::removedFrom(RemovalType removalType, ContainerNode& parentOfRemovedTree)
 {
-    HTMLElement::removedFrom(insertionPoint);
-    if (insertionPoint.isConnected()) {
+    HTMLElement::removedFrom(removalType, parentOfRemovedTree);
+    if (removalType.disconnectedFromDocument) {
         if (RefPtr<Frame> frame = document().frame())
             frame->loader().client().dispatchDidBecomeFrameset(document().isFrameSet());
     }

Modified: trunk/Source/WebCore/html/HTMLFrameSetElement.h (223684 => 223685)


--- trunk/Source/WebCore/html/HTMLFrameSetElement.h	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/html/HTMLFrameSetElement.h	2017-10-19 10:05:21 UTC (rev 223685)
@@ -65,7 +65,7 @@
     void willRecalcStyle(Style::Change) final;
 
     InsertedIntoResult insertedInto(InsertionType, ContainerNode&) final;
-    void removedFrom(ContainerNode&) final;
+    void removedFrom(RemovalType, ContainerNode&) final;
 
     std::unique_ptr<Length[]> m_rowLengths;
     std::unique_ptr<Length[]> m_colLengths;

Modified: trunk/Source/WebCore/html/HTMLImageElement.cpp (223684 => 223685)


--- trunk/Source/WebCore/html/HTMLImageElement.cpp	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/html/HTMLImageElement.cpp	2017-10-19 10:05:21 UTC (rev 223685)
@@ -331,19 +331,19 @@
     return insertNotificationRequest;
 }
 
-void HTMLImageElement::removedFrom(ContainerNode& insertionPoint)
+void HTMLImageElement::removedFrom(RemovalType removalType, ContainerNode& parentOfRemovedTree)
 {
     if (m_form)
         m_form->removeImgElement(this);
 
-    if (insertionPoint.isConnected() && !m_parsedUsemap.isNull())
+    if (removalType.disconnectedFromDocument && !m_parsedUsemap.isNull())
         document().removeImageElementByUsemap(*m_parsedUsemap.impl(), *this);
-    
+
     if (is<HTMLPictureElement>(parentNode()))
         setPictureElement(nullptr);
-    
+
     m_form = nullptr;
-    HTMLElement::removedFrom(insertionPoint);
+    HTMLElement::removedFrom(removalType, parentOfRemovedTree);
 }
 
 HTMLPictureElement* HTMLImageElement::pictureElement() const

Modified: trunk/Source/WebCore/html/HTMLImageElement.h (223684 => 223685)


--- trunk/Source/WebCore/html/HTMLImageElement.h	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/html/HTMLImageElement.h	2017-10-19 10:05:21 UTC (rev 223685)
@@ -121,7 +121,7 @@
     void addSubresourceAttributeURLs(ListHashSet<URL>&) const override;
 
     InsertedIntoResult insertedInto(InsertionType, ContainerNode&) override;
-    void removedFrom(ContainerNode&) override;
+    void removedFrom(RemovalType, ContainerNode&) override;
 
     bool isFormAssociatedElement() const final { return false; }
     FormNamedItem* asFormNamedItem() final { return this; }

Modified: trunk/Source/WebCore/html/HTMLInputElement.cpp (223684 => 223685)


--- trunk/Source/WebCore/html/HTMLInputElement.cpp	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/html/HTMLInputElement.cpp	2017-10-19 10:05:21 UTC (rev 223685)
@@ -1519,11 +1519,11 @@
         addToRadioButtonGroup();
 }
 
-void HTMLInputElement::removedFrom(ContainerNode& insertionPoint)
+void HTMLInputElement::removedFrom(RemovalType removalType, ContainerNode& parentOfRemovedTree)
 {
-    if (insertionPoint.isConnected() && !form())
+    if (removalType.disconnectedFromDocument && !form())
         removeFromRadioButtonGroup();
-    HTMLTextFormControlElement::removedFrom(insertionPoint);
+    HTMLTextFormControlElement::removedFrom(removalType, parentOfRemovedTree);
     ASSERT(!isConnected());
 #if ENABLE(DATALIST_ELEMENT)
     resetListAttributeTargetObserver();

Modified: trunk/Source/WebCore/html/HTMLInputElement.h (223684 => 223685)


--- trunk/Source/WebCore/html/HTMLInputElement.h	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/html/HTMLInputElement.h	2017-10-19 10:05:21 UTC (rev 223685)
@@ -352,7 +352,7 @@
     void didChangeForm() final;
     InsertedIntoResult insertedInto(InsertionType, ContainerNode&) final;
     void didFinishInsertingNode() final;
-    void removedFrom(ContainerNode&) final;
+    void removedFrom(RemovalType, ContainerNode&) final;
     void didMoveToNewDocument(Document& oldDocument, Document& newDocument) final;
 
     bool hasCustomFocusLogic() const final;

Modified: trunk/Source/WebCore/html/HTMLLinkElement.cpp (223684 => 223685)


--- trunk/Source/WebCore/html/HTMLLinkElement.cpp	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/html/HTMLLinkElement.cpp	2017-10-19 10:05:21 UTC (rev 223685)
@@ -357,10 +357,10 @@
     process();
 }
 
-void HTMLLinkElement::removedFrom(ContainerNode& insertionPoint)
+void HTMLLinkElement::removedFrom(RemovalType removalType, ContainerNode& parentOfRemovedTree)
 {
-    HTMLElement::removedFrom(insertionPoint);
-    if (!insertionPoint.isConnected() || isConnected())
+    HTMLElement::removedFrom(removalType, parentOfRemovedTree);
+    if (!removalType.disconnectedFromDocument)
         return;
 
     m_linkLoader.cancelLoad();

Modified: trunk/Source/WebCore/html/HTMLLinkElement.h (223684 => 223685)


--- trunk/Source/WebCore/html/HTMLLinkElement.h	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/html/HTMLLinkElement.h	2017-10-19 10:05:21 UTC (rev 223685)
@@ -83,7 +83,7 @@
 
     InsertedIntoResult insertedInto(InsertionType, ContainerNode&) final;
     void didFinishInsertingNode() final;
-    void removedFrom(ContainerNode&) final;
+    void removedFrom(RemovalType, ContainerNode&) final;
 
     void initializeStyleSheet(Ref<StyleSheetContents>&&, const CachedCSSStyleSheet&);
 

Modified: trunk/Source/WebCore/html/HTMLMapElement.cpp (223684 => 223685)


--- trunk/Source/WebCore/html/HTMLMapElement.cpp	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/html/HTMLMapElement.cpp	2017-10-19 10:05:21 UTC (rev 223685)
@@ -122,11 +122,11 @@
     return request;
 }
 
-void HTMLMapElement::removedFrom(ContainerNode& insertionPoint)
+void HTMLMapElement::removedFrom(RemovalType removalType, ContainerNode& parentOfRemovedTree)
 {
-    if (insertionPoint.isConnected())
+    if (removalType.disconnectedFromDocument)
         treeScope().removeImageMap(*this);
-    HTMLElement::removedFrom(insertionPoint);
+    HTMLElement::removedFrom(removalType, parentOfRemovedTree);
 }
 
 }

Modified: trunk/Source/WebCore/html/HTMLMapElement.h (223684 => 223685)


--- trunk/Source/WebCore/html/HTMLMapElement.h	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/html/HTMLMapElement.h	2017-10-19 10:05:21 UTC (rev 223685)
@@ -48,7 +48,7 @@
     void parseAttribute(const QualifiedName&, const AtomicString&) final;
 
     InsertedIntoResult insertedInto(InsertionType, ContainerNode&) final;
-    void removedFrom(ContainerNode&) final;
+    void removedFrom(RemovalType, ContainerNode&) final;
 
     AtomicString m_name;
 };

Modified: trunk/Source/WebCore/html/HTMLMediaElement.cpp (223684 => 223685)


--- trunk/Source/WebCore/html/HTMLMediaElement.cpp	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/html/HTMLMediaElement.cpp	2017-10-19 10:05:21 UTC (rev 223685)
@@ -930,17 +930,17 @@
     }
 }
 
-void HTMLMediaElement::removedFrom(ContainerNode& insertionPoint)
+void HTMLMediaElement::removedFrom(RemovalType removalType, ContainerNode& parentOfRemovedTree)
 {
     INFO_LOG(LOGIDENTIFIER);
 
     m_inActiveDocument = false;
-    if (insertionPoint.isConnected()) {
+    if (removalType.disconnectedFromDocument) {
         // Pause asynchronously to let the operation that removed us finish, in case we get inserted back into a document.
         m_pauseAfterDetachedTaskQueue.enqueueTask(std::bind(&HTMLMediaElement::pauseAfterDetachedTask, this));
     }
 
-    HTMLElement::removedFrom(insertionPoint);
+    HTMLElement::removedFrom(removalType, parentOfRemovedTree);
 }
 
 void HTMLMediaElement::willAttachRenderers()

Modified: trunk/Source/WebCore/html/HTMLMediaElement.h (223684 => 223685)


--- trunk/Source/WebCore/html/HTMLMediaElement.h	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/html/HTMLMediaElement.h	2017-10-19 10:05:21 UTC (rev 223685)
@@ -590,7 +590,7 @@
     bool childShouldCreateRenderer(const Node&) const override;
     InsertedIntoResult insertedInto(InsertionType, ContainerNode&) override;
     void didFinishInsertingNode() override;
-    void removedFrom(ContainerNode&) override;
+    void removedFrom(RemovalType, ContainerNode&) override;
     void didRecalcStyle(Style::Change) override;
 
     void willBecomeFullscreenElement() override;

Modified: trunk/Source/WebCore/html/HTMLObjectElement.cpp (223684 => 223685)


--- trunk/Source/WebCore/html/HTMLObjectElement.cpp	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/html/HTMLObjectElement.cpp	2017-10-19 10:05:21 UTC (rev 223685)
@@ -325,10 +325,10 @@
     resetFormOwner();
 }
 
-void HTMLObjectElement::removedFrom(ContainerNode& insertionPoint)
+void HTMLObjectElement::removedFrom(RemovalType removalType, ContainerNode& parentOfRemovedTree)
 {
-    HTMLPlugInImageElement::removedFrom(insertionPoint);
-    FormAssociatedElement::removedFrom(insertionPoint);
+    HTMLPlugInImageElement::removedFrom(removalType, parentOfRemovedTree);
+    FormAssociatedElement::removedFrom(removalType, parentOfRemovedTree);
 }
 
 void HTMLObjectElement::childrenChanged(const ChildChange& change)

Modified: trunk/Source/WebCore/html/HTMLObjectElement.h (223684 => 223685)


--- trunk/Source/WebCore/html/HTMLObjectElement.h	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/html/HTMLObjectElement.h	2017-10-19 10:05:21 UTC (rev 223685)
@@ -64,7 +64,7 @@
 
     InsertedIntoResult insertedInto(InsertionType, ContainerNode&) final;
     void didFinishInsertingNode() final;
-    void removedFrom(ContainerNode&) final;
+    void removedFrom(RemovalType, ContainerNode&) final;
 
     void didMoveToNewDocument(Document& oldDocument, Document& newDocument) final;
 

Modified: trunk/Source/WebCore/html/HTMLSlotElement.cpp (223684 => 223685)


--- trunk/Source/WebCore/html/HTMLSlotElement.cpp	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/html/HTMLSlotElement.cpp	2017-10-19 10:05:21 UTC (rev 223685)
@@ -61,17 +61,15 @@
     return InsertedIntoResult::Done;
 }
 
-void HTMLSlotElement::removedFrom(ContainerNode& insertionPoint)
+void HTMLSlotElement::removedFrom(RemovalType removalType, ContainerNode& parentOfRemovedTree)
 {
-    // ContainerNode::removeBetween always sets the removed child's tree scope to Document's but InShadowRoot flag is unset in Node::removedFrom.
-    // So if InShadowRoot flag is set but this element's tree scope is Document's, this element has just been removed from a shadow root.
-    if (insertionPoint.isInShadowTree() && isInShadowTree() && &treeScope() == &document()) {
-        auto* oldShadowRoot = insertionPoint.containingShadowRoot();
+    if (removalType.treeScopeChanged && parentOfRemovedTree.isInShadowTree()) {
+        auto* oldShadowRoot = parentOfRemovedTree.containingShadowRoot();
         ASSERT(oldShadowRoot);
         oldShadowRoot->removeSlotElementByName(attributeWithoutSynchronization(nameAttr), *this);
     }
 
-    HTMLElement::removedFrom(insertionPoint);
+    HTMLElement::removedFrom(removalType, parentOfRemovedTree);
 }
 
 void HTMLSlotElement::attributeChanged(const QualifiedName& name, const AtomicString& oldValue, const AtomicString& newValue, AttributeModificationReason reason)

Modified: trunk/Source/WebCore/html/HTMLSlotElement.h (223684 => 223685)


--- trunk/Source/WebCore/html/HTMLSlotElement.h	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/html/HTMLSlotElement.h	2017-10-19 10:05:21 UTC (rev 223685)
@@ -49,7 +49,7 @@
     HTMLSlotElement(const QualifiedName&, Document&);
 
     InsertedIntoResult insertedInto(InsertionType, ContainerNode&) final;
-    void removedFrom(ContainerNode&) final;
+    void removedFrom(RemovalType, ContainerNode&) final;
     void attributeChanged(const QualifiedName&, const AtomicString& oldValue, const AtomicString& newValue, AttributeModificationReason) final;
 
     bool m_inSignalSlotList { false };

Modified: trunk/Source/WebCore/html/HTMLSourceElement.cpp (223684 => 223685)


--- trunk/Source/WebCore/html/HTMLSourceElement.cpp	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/html/HTMLSourceElement.cpp	2017-10-19 10:05:21 UTC (rev 223685)
@@ -66,6 +66,7 @@
 Node::InsertedIntoResult HTMLSourceElement::insertedInto(InsertionType insertionType, ContainerNode& parentOfInsertedTree)
 {
     HTMLElement::insertedInto(insertionType, parentOfInsertedTree);
+    // FIXME: This code is wrong if an ancestor of the parent had been inserted.
     if (auto* parent = parentElement()) {
 #if ENABLE(VIDEO)
         if (is<HTMLMediaElement>(*parent))
@@ -78,11 +79,12 @@
     return InsertedIntoResult::Done;
 }
 
-void HTMLSourceElement::removedFrom(ContainerNode& removalRoot)
+void HTMLSourceElement::removedFrom(RemovalType removalType, ContainerNode& parentOfRemovedTree)
 {
+    // FIXME: This code is wrong if an ancestor of the parent had been removed.
     RefPtr<Element> parent = parentElement();
-    if (!parent && is<Element>(removalRoot))
-        parent = &downcast<Element>(removalRoot);
+    if (!parent && is<Element>(parentOfRemovedTree))
+        parent = &downcast<Element>(parentOfRemovedTree);
     if (parent) {
 #if ENABLE(VIDEO)
         if (is<HTMLMediaElement>(*parent))
@@ -92,7 +94,7 @@
         if (is<HTMLPictureElement>(*parent))
             downcast<HTMLPictureElement>(*parent).sourcesChanged();
     }
-    HTMLElement::removedFrom(removalRoot);
+    HTMLElement::removedFrom(removalType, parentOfRemovedTree);
 }
 
 void HTMLSourceElement::scheduleErrorEvent()

Modified: trunk/Source/WebCore/html/HTMLSourceElement.h (223684 => 223685)


--- trunk/Source/WebCore/html/HTMLSourceElement.h	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/html/HTMLSourceElement.h	2017-10-19 10:05:21 UTC (rev 223685)
@@ -46,7 +46,7 @@
     HTMLSourceElement(const QualifiedName&, Document&);
     
     InsertedIntoResult insertedInto(InsertionType, ContainerNode&) final;
-    void removedFrom(ContainerNode&) final;
+    void removedFrom(RemovalType, ContainerNode&) final;
     bool isURLAttribute(const Attribute&) const final;
 
     // ActiveDOMObject.

Modified: trunk/Source/WebCore/html/HTMLStyleElement.cpp (223684 => 223685)


--- trunk/Source/WebCore/html/HTMLStyleElement.cpp	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/html/HTMLStyleElement.cpp	2017-10-19 10:05:21 UTC (rev 223685)
@@ -104,10 +104,10 @@
     return result;
 }
 
-void HTMLStyleElement::removedFrom(ContainerNode& insertionPoint)
+void HTMLStyleElement::removedFrom(RemovalType removalType, ContainerNode& parentOfRemovedTree)
 {
-    HTMLElement::removedFrom(insertionPoint);
-    if (insertionPoint.isConnected() && !isConnected())
+    HTMLElement::removedFrom(removalType, parentOfRemovedTree);
+    if (removalType.disconnectedFromDocument)
         m_styleSheetOwner.removedFromDocument(*this);
 }
 

Modified: trunk/Source/WebCore/html/HTMLStyleElement.h (223684 => 223685)


--- trunk/Source/WebCore/html/HTMLStyleElement.h	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/html/HTMLStyleElement.h	2017-10-19 10:05:21 UTC (rev 223685)
@@ -55,7 +55,7 @@
 
     void parseAttribute(const QualifiedName&, const AtomicString&) final;
     InsertedIntoResult insertedInto(InsertionType, ContainerNode&) final;
-    void removedFrom(ContainerNode&) final;
+    void removedFrom(RemovalType, ContainerNode&) final;
     void childrenChanged(const ChildChange&) final;
 
     bool isLoading() const { return m_styleSheetOwner.isLoading(); }

Modified: trunk/Source/WebCore/html/HTMLTitleElement.cpp (223684 => 223685)


--- trunk/Source/WebCore/html/HTMLTitleElement.cpp	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/html/HTMLTitleElement.cpp	2017-10-19 10:05:21 UTC (rev 223685)
@@ -57,9 +57,9 @@
     return InsertedIntoResult::Done;
 }
 
-void HTMLTitleElement::removedFrom(ContainerNode& insertionPoint)
+void HTMLTitleElement::removedFrom(RemovalType removalType, ContainerNode& parentOfRemovedTree)
 {
-    HTMLElement::removedFrom(insertionPoint);
+    HTMLElement::removedFrom(removalType, parentOfRemovedTree);
     document().titleElementRemoved(*this);
 }
 

Modified: trunk/Source/WebCore/html/HTMLTitleElement.h (223684 => 223685)


--- trunk/Source/WebCore/html/HTMLTitleElement.h	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/html/HTMLTitleElement.h	2017-10-19 10:05:21 UTC (rev 223685)
@@ -40,7 +40,7 @@
     HTMLTitleElement(const QualifiedName&, Document&);
 
     InsertedIntoResult insertedInto(InsertionType, ContainerNode&) final;
-    void removedFrom(ContainerNode&) final;
+    void removedFrom(RemovalType, ContainerNode&) final;
     void childrenChanged(const ChildChange&) final;
 
     StringWithDirection computedTextWithDirection();

Modified: trunk/Source/WebCore/html/HTMLTrackElement.cpp (223684 => 223685)


--- trunk/Source/WebCore/html/HTMLTrackElement.cpp	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/html/HTMLTrackElement.cpp	2017-10-19 10:05:21 UTC (rev 223685)
@@ -91,12 +91,14 @@
     return InsertedIntoResult::Done;
 }
 
-void HTMLTrackElement::removedFrom(ContainerNode& insertionPoint)
+void HTMLTrackElement::removedFrom(RemovalType removalType, ContainerNode& parentOfRemovedTree)
 {
-    HTMLElement::removedFrom(insertionPoint);
+    HTMLElement::removedFrom(removalType, parentOfRemovedTree);
 
-    if (is<HTMLMediaElement>(insertionPoint))
-        downcast<HTMLMediaElement>(insertionPoint).didRemoveTextTrack(*this);
+    // FIXME: This code is wrong. If HTMLTrackElement can be any descendent of HTMLMediaElement, then check ancestors of parentOfInsertedTree.
+    // If HTMLMediaElement only supports HTMLTrackElement which is an immediate child, then check parentNode() instead.
+    if (is<HTMLMediaElement>(parentOfRemovedTree))
+        downcast<HTMLMediaElement>(parentOfRemovedTree).didRemoveTextTrack(*this);
 }
 
 void HTMLTrackElement::parseAttribute(const QualifiedName& name, const AtomicString& value)

Modified: trunk/Source/WebCore/html/HTMLTrackElement.h (223684 => 223685)


--- trunk/Source/WebCore/html/HTMLTrackElement.h	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/html/HTMLTrackElement.h	2017-10-19 10:05:21 UTC (rev 223685)
@@ -66,7 +66,7 @@
     void parseAttribute(const QualifiedName&, const AtomicString&) final;
 
     InsertedIntoResult insertedInto(InsertionType, ContainerNode&) final;
-    void removedFrom(ContainerNode&) final;
+    void removedFrom(RemovalType, ContainerNode&) final;
 
     bool isURLAttribute(const Attribute&) const final;
 

Modified: trunk/Source/WebCore/svg/SVGElement.cpp (223684 => 223685)


--- trunk/Source/WebCore/svg/SVGElement.cpp	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/svg/SVGElement.cpp	2017-10-19 10:05:21 UTC (rev 223685)
@@ -365,15 +365,14 @@
     ASSERT_NOT_REACHED();
 }
 
-void SVGElement::removedFrom(ContainerNode& rootParent)
+void SVGElement::removedFrom(RemovalType removalType, ContainerNode& parentOfRemovedTree)
 {
-    bool wasInDocument = rootParent.isConnected();
-    if (wasInDocument)
+    if (removalType.disconnectedFromDocument)
         updateRelativeLengthsInformation(false, this);
 
-    StyledElement::removedFrom(rootParent);
+    StyledElement::removedFrom(removalType, parentOfRemovedTree);
 
-    if (wasInDocument) {
+    if (removalType.disconnectedFromDocument) {
         document().accessSVGExtensions().clearTargetDependencies(*this);
         document().accessSVGExtensions().removeAllElementReferencesForTarget(this);
     }

Modified: trunk/Source/WebCore/svg/SVGElement.h (223684 => 223685)


--- trunk/Source/WebCore/svg/SVGElement.h	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/svg/SVGElement.h	2017-10-19 10:05:21 UTC (rev 223685)
@@ -160,7 +160,7 @@
     bool isPresentationAttribute(const QualifiedName&) const override;
     void collectStyleForPresentationAttribute(const QualifiedName&, const AtomicString&, MutableStyleProperties&) override;
     InsertedIntoResult insertedInto(InsertionType, ContainerNode&) override;
-    void removedFrom(ContainerNode&) override;
+    void removedFrom(RemovalType, ContainerNode&) override;
     void childrenChanged(const ChildChange&) override;
     virtual bool selfHasRelativeLengths() const { return false; }
     void updateRelativeLengthsInformation() { updateRelativeLengthsInformation(selfHasRelativeLengths(), this); }

Modified: trunk/Source/WebCore/svg/SVGFEImageElement.cpp (223684 => 223685)


--- trunk/Source/WebCore/svg/SVGFEImageElement.cpp	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/svg/SVGFEImageElement.cpp	2017-10-19 10:05:21 UTC (rev 223685)
@@ -161,10 +161,10 @@
     buildPendingResource();
 }
 
-void SVGFEImageElement::removedFrom(ContainerNode& rootParent)
+void SVGFEImageElement::removedFrom(RemovalType removalType, ContainerNode& parentOfRemovedTree)
 {
-    SVGFilterPrimitiveStandardAttributes::removedFrom(rootParent);
-    if (rootParent.isConnected())
+    SVGFilterPrimitiveStandardAttributes::removedFrom(removalType, parentOfRemovedTree);
+    if (removalType.disconnectedFromDocument)
         clearResourceReferences();
 }
 

Modified: trunk/Source/WebCore/svg/SVGFEImageElement.h (223684 => 223685)


--- trunk/Source/WebCore/svg/SVGFEImageElement.h	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/svg/SVGFEImageElement.h	2017-10-19 10:05:21 UTC (rev 223685)
@@ -59,7 +59,7 @@
 
     void buildPendingResource() override;
     InsertedIntoResult insertedInto(InsertionType, ContainerNode&) override;
-    void removedFrom(ContainerNode&) override;
+    void removedFrom(RemovalType, ContainerNode&) override;
 
     BEGIN_DECLARE_ANIMATED_PROPERTIES(SVGFEImageElement)
         DECLARE_ANIMATED_PRESERVEASPECTRATIO(PreserveAspectRatio, preserveAspectRatio)

Modified: trunk/Source/WebCore/svg/SVGFontFaceElement.cpp (223684 => 223685)


--- trunk/Source/WebCore/svg/SVGFontFaceElement.cpp	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/svg/SVGFontFaceElement.cpp	2017-10-19 10:05:21 UTC (rev 223685)
@@ -284,11 +284,11 @@
     return InsertedIntoResult::Done;
 }
 
-void SVGFontFaceElement::removedFrom(ContainerNode& rootParent)
+void SVGFontFaceElement::removedFrom(RemovalType removalType, ContainerNode& parentOfRemovedTree)
 {
-    SVGElement::removedFrom(rootParent);
+    SVGElement::removedFrom(removalType, parentOfRemovedTree);
 
-    if (rootParent.isConnected()) {
+    if (removalType.disconnectedFromDocument) {
         m_fontElement = nullptr;
         document().accessSVGExtensions().unregisterSVGFontFaceElement(this);
         m_fontFaceRule->mutableProperties().clear();

Modified: trunk/Source/WebCore/svg/SVGFontFaceElement.h (223684 => 223685)


--- trunk/Source/WebCore/svg/SVGFontFaceElement.h	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/svg/SVGFontFaceElement.h	2017-10-19 10:05:21 UTC (rev 223685)
@@ -59,7 +59,7 @@
 
     void childrenChanged(const ChildChange&) final;
     InsertedIntoResult insertedInto(InsertionType, ContainerNode&) final;
-    void removedFrom(ContainerNode&) final;
+    void removedFrom(RemovalType, ContainerNode&) final;
 
     bool rendererIsNeeded(const RenderStyle&) final { return false; }
 

Modified: trunk/Source/WebCore/svg/SVGMPathElement.cpp (223684 => 223685)


--- trunk/Source/WebCore/svg/SVGMPathElement.cpp	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/svg/SVGMPathElement.cpp	2017-10-19 10:05:21 UTC (rev 223685)
@@ -99,11 +99,11 @@
     buildPendingResource();
 }
 
-void SVGMPathElement::removedFrom(ContainerNode& rootParent)
+void SVGMPathElement::removedFrom(RemovalType removalType, ContainerNode& parentOfRemovedTree)
 {
-    SVGElement::removedFrom(rootParent);
-    notifyParentOfPathChange(&rootParent);
-    if (rootParent.isConnected())
+    SVGElement::removedFrom(removalType, parentOfRemovedTree);
+    notifyParentOfPathChange(&parentOfRemovedTree);
+    if (removalType.disconnectedFromDocument)
         clearResourceReferences();
 }
 

Modified: trunk/Source/WebCore/svg/SVGMPathElement.h (223684 => 223685)


--- trunk/Source/WebCore/svg/SVGMPathElement.h	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/svg/SVGMPathElement.h	2017-10-19 10:05:21 UTC (rev 223685)
@@ -46,7 +46,7 @@
     void buildPendingResource() final;
     void clearResourceReferences();
     InsertedIntoResult insertedInto(InsertionType, ContainerNode&) final;
-    void removedFrom(ContainerNode&) final;
+    void removedFrom(RemovalType, ContainerNode&) final;
 
     void parseAttribute(const QualifiedName&, const AtomicString&) final;
     void svgAttributeChanged(const QualifiedName&) final;

Modified: trunk/Source/WebCore/svg/SVGPathElement.cpp (223684 => 223685)


--- trunk/Source/WebCore/svg/SVGPathElement.cpp	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/svg/SVGPathElement.cpp	2017-10-19 10:05:21 UTC (rev 223685)
@@ -286,9 +286,9 @@
     return InsertedIntoResult::Done;
 }
 
-void SVGPathElement::removedFrom(ContainerNode& rootParent)
+void SVGPathElement::removedFrom(RemovalType removalType, ContainerNode& parentOfRemovedTree)
 {
-    SVGGraphicsElement::removedFrom(rootParent);
+    SVGGraphicsElement::removedFrom(removalType, parentOfRemovedTree);
     invalidateMPathDependencies();
 }
 

Modified: trunk/Source/WebCore/svg/SVGPathElement.h (223684 => 223685)


--- trunk/Source/WebCore/svg/SVGPathElement.h	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/svg/SVGPathElement.h	2017-10-19 10:05:21 UTC (rev 223685)
@@ -125,7 +125,7 @@
     RenderPtr<RenderElement> createElementRenderer(RenderStyle&&, const RenderTreePosition&) final;
 
     Node::InsertedIntoResult insertedInto(InsertionType, ContainerNode&) final;
-    void removedFrom(ContainerNode&) final;
+    void removedFrom(RemovalType, ContainerNode&) final;
 
     void invalidateMPathDependencies();
 

Modified: trunk/Source/WebCore/svg/SVGSVGElement.cpp (223684 => 223685)


--- trunk/Source/WebCore/svg/SVGSVGElement.cpp	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/svg/SVGSVGElement.cpp	2017-10-19 10:05:21 UTC (rev 223685)
@@ -483,13 +483,13 @@
     return SVGGraphicsElement::insertedInto(insertionType, parentOfInsertedTree);
 }
 
-void SVGSVGElement::removedFrom(ContainerNode& rootParent)
+void SVGSVGElement::removedFrom(RemovalType removalType, ContainerNode& parentOfRemovedTree)
 {
-    if (rootParent.isConnected()) {
+    if (removalType.disconnectedFromDocument) {
         document().accessSVGExtensions().removeTimeContainer(this);
         pauseAnimations();
     }
-    SVGGraphicsElement::removedFrom(rootParent);
+    SVGGraphicsElement::removedFrom(removalType, parentOfRemovedTree);
 }
 
 void SVGSVGElement::pauseAnimations()

Modified: trunk/Source/WebCore/svg/SVGSVGElement.h (223684 => 223685)


--- trunk/Source/WebCore/svg/SVGSVGElement.h	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/svg/SVGSVGElement.h	2017-10-19 10:05:21 UTC (rev 223685)
@@ -144,7 +144,7 @@
     bool rendererIsNeeded(const RenderStyle&) override;
     RenderPtr<RenderElement> createElementRenderer(RenderStyle&&, const RenderTreePosition&) override;
     InsertedIntoResult insertedInto(InsertionType, ContainerNode&) override;
-    void removedFrom(ContainerNode&) override;
+    void removedFrom(RemovalType, ContainerNode&) override;
     void svgAttributeChanged(const QualifiedName&) override;
     bool selfHasRelativeLengths() const override;
     void prepareForDocumentSuspension() override;

Modified: trunk/Source/WebCore/svg/SVGStyleElement.cpp (223684 => 223685)


--- trunk/Source/WebCore/svg/SVGStyleElement.cpp	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/svg/SVGStyleElement.cpp	2017-10-19 10:05:21 UTC (rev 223685)
@@ -121,10 +121,10 @@
     return result;
 }
 
-void SVGStyleElement::removedFrom(ContainerNode& rootParent)
+void SVGStyleElement::removedFrom(RemovalType removalType, ContainerNode& parentOfRemovedTree)
 {
-    SVGElement::removedFrom(rootParent);
-    if (rootParent.isConnected() && !isConnected())
+    SVGElement::removedFrom(removalType, parentOfRemovedTree);
+    if (removalType.disconnectedFromDocument)
         m_styleSheetOwner.removedFromDocument(*this);
 }
 

Modified: trunk/Source/WebCore/svg/SVGStyleElement.h (223684 => 223685)


--- trunk/Source/WebCore/svg/SVGStyleElement.h	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/svg/SVGStyleElement.h	2017-10-19 10:05:21 UTC (rev 223685)
@@ -47,7 +47,7 @@
 
     void parseAttribute(const QualifiedName&, const AtomicString&) final;
     InsertedIntoResult insertedInto(InsertionType, ContainerNode&) final;
-    void removedFrom(ContainerNode&) final;
+    void removedFrom(RemovalType, ContainerNode&) final;
     void childrenChanged(const ChildChange&) final;
 
     bool rendererIsNeeded(const RenderStyle&) final { return false; }

Modified: trunk/Source/WebCore/svg/SVGTRefElement.cpp (223684 => 223685)


--- trunk/Source/WebCore/svg/SVGTRefElement.cpp	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/svg/SVGTRefElement.cpp	2017-10-19 10:05:21 UTC (rev 223685)
@@ -267,10 +267,10 @@
     buildPendingResource();
 }
 
-void SVGTRefElement::removedFrom(ContainerNode& rootParent)
+void SVGTRefElement::removedFrom(RemovalType removalType, ContainerNode& parentOfRemovedTree)
 {
-    SVGElement::removedFrom(rootParent);
-    if (rootParent.isConnected())
+    SVGElement::removedFrom(removalType, parentOfRemovedTree);
+    if (removalType.disconnectedFromDocument)
         m_targetListener->detach();
 }
 

Modified: trunk/Source/WebCore/svg/SVGTRefElement.h (223684 => 223685)


--- trunk/Source/WebCore/svg/SVGTRefElement.h	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/svg/SVGTRefElement.h	2017-10-19 10:05:21 UTC (rev 223685)
@@ -45,7 +45,7 @@
     bool rendererIsNeeded(const RenderStyle&) override;
 
     InsertedIntoResult insertedInto(InsertionType, ContainerNode&) override;
-    void removedFrom(ContainerNode&) override;
+    void removedFrom(RemovalType, ContainerNode&) override;
     void didFinishInsertingNode() override;
 
     void clearTarget() override;

Modified: trunk/Source/WebCore/svg/SVGTextPathElement.cpp (223684 => 223685)


--- trunk/Source/WebCore/svg/SVGTextPathElement.cpp	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/svg/SVGTextPathElement.cpp	2017-10-19 10:05:21 UTC (rev 223685)
@@ -184,10 +184,10 @@
     buildPendingResource();
 }
 
-void SVGTextPathElement::removedFrom(ContainerNode& rootParent)
+void SVGTextPathElement::removedFrom(RemovalType removalType, ContainerNode& parentOfRemovedTree)
 {
-    SVGTextContentElement::removedFrom(rootParent);
-    if (rootParent.isConnected())
+    SVGTextContentElement::removedFrom(removalType, parentOfRemovedTree);
+    if (removalType.disconnectedFromDocument)
         clearResourceReferences();
 }
 

Modified: trunk/Source/WebCore/svg/SVGTextPathElement.h (223684 => 223685)


--- trunk/Source/WebCore/svg/SVGTextPathElement.h	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/svg/SVGTextPathElement.h	2017-10-19 10:05:21 UTC (rev 223685)
@@ -122,7 +122,7 @@
 
     void buildPendingResource() override;
     InsertedIntoResult insertedInto(InsertionType, ContainerNode&) override;
-    void removedFrom(ContainerNode&) override;
+    void removedFrom(RemovalType, ContainerNode&) override;
 
     static bool isSupportedAttribute(const QualifiedName&);
     void parseAttribute(const QualifiedName&, const AtomicString&) override;

Modified: trunk/Source/WebCore/svg/SVGTitleElement.cpp (223684 => 223685)


--- trunk/Source/WebCore/svg/SVGTitleElement.cpp	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/svg/SVGTitleElement.cpp	2017-10-19 10:05:21 UTC (rev 223685)
@@ -45,9 +45,9 @@
     return InsertedIntoResult::Done;
 }
 
-void SVGTitleElement::removedFrom(ContainerNode& insertionPoint)
+void SVGTitleElement::removedFrom(RemovalType removalType, ContainerNode& parentOfRemovedTree)
 {
-    SVGElement::removedFrom(insertionPoint);
+    SVGElement::removedFrom(removalType, parentOfRemovedTree);
     document().titleElementRemoved(*this);
 }
 

Modified: trunk/Source/WebCore/svg/SVGTitleElement.h (223684 => 223685)


--- trunk/Source/WebCore/svg/SVGTitleElement.h	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/svg/SVGTitleElement.h	2017-10-19 10:05:21 UTC (rev 223685)
@@ -33,7 +33,7 @@
     SVGTitleElement(const QualifiedName&, Document&);
 
     InsertedIntoResult insertedInto(InsertionType, ContainerNode&) final;
-    void removedFrom(ContainerNode&) final;
+    void removedFrom(RemovalType, ContainerNode&) final;
     void childrenChanged(const ChildChange&) final;
 
     bool rendererIsNeeded(const RenderStyle&) final { return false; }

Modified: trunk/Source/WebCore/svg/SVGUseElement.cpp (223684 => 223685)


--- trunk/Source/WebCore/svg/SVGUseElement.cpp	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/svg/SVGUseElement.cpp	2017-10-19 10:05:21 UTC (rev 223685)
@@ -114,9 +114,9 @@
     return InsertedIntoResult::Done;
 }
 
-void SVGUseElement::removedFrom(ContainerNode& rootParent)
+void SVGUseElement::removedFrom(RemovalType removalType, ContainerNode& parentOfRemovedTree)
 {
-    SVGGraphicsElement::removedFrom(rootParent);
+    SVGGraphicsElement::removedFrom(removalType, parentOfRemovedTree);
     clearShadowTree();
     updateExternalDocument();
 }

Modified: trunk/Source/WebCore/svg/SVGUseElement.h (223684 => 223685)


--- trunk/Source/WebCore/svg/SVGUseElement.h	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/svg/SVGUseElement.h	2017-10-19 10:05:21 UTC (rev 223685)
@@ -58,7 +58,7 @@
 
     bool isValid() const override;
     InsertedIntoResult insertedInto(InsertionType, ContainerNode&) override;
-    void removedFrom(ContainerNode&) override;
+    void removedFrom(RemovalType, ContainerNode&) override;
     void buildPendingResource() override;
     void parseAttribute(const QualifiedName&, const AtomicString&) override;
     void svgAttributeChanged(const QualifiedName&) override;

Modified: trunk/Source/WebCore/svg/animation/SVGSMILElement.cpp (223684 => 223685)


--- trunk/Source/WebCore/svg/animation/SVGSMILElement.cpp	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/svg/animation/SVGSMILElement.cpp	2017-10-19 10:05:21 UTC (rev 223685)
@@ -288,9 +288,9 @@
     buildPendingResource();
 }
 
-void SVGSMILElement::removedFrom(ContainerNode& rootParent)
+void SVGSMILElement::removedFrom(RemovalType removalType, ContainerNode& parentOfRemovedTree)
 {
-    if (rootParent.isConnected()) {
+    if (removalType.disconnectedFromDocument) {
         clearResourceReferences();
         disconnectConditions();
         setTargetElement(nullptr);
@@ -299,7 +299,7 @@
         m_timeContainer = nullptr;
     }
 
-    SVGElement::removedFrom(rootParent);
+    SVGElement::removedFrom(removalType, parentOfRemovedTree);
 }
 
 bool SVGSMILElement::hasValidAttributeName()

Modified: trunk/Source/WebCore/svg/animation/SVGSMILElement.h (223684 => 223685)


--- trunk/Source/WebCore/svg/animation/SVGSMILElement.h	2017-10-19 08:37:41 UTC (rev 223684)
+++ trunk/Source/WebCore/svg/animation/SVGSMILElement.h	2017-10-19 10:05:21 UTC (rev 223685)
@@ -48,7 +48,7 @@
     void parseAttribute(const QualifiedName&, const AtomicString&) override;
     void svgAttributeChanged(const QualifiedName&) override;
     InsertedIntoResult insertedInto(InsertionType, ContainerNode&) override;
-    void removedFrom(ContainerNode&) override;
+    void removedFrom(RemovalType, ContainerNode&) override;
     
     virtual bool hasValidAttributeType() = 0;
     virtual bool hasValidAttributeName();
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to