commit 396316b0bd382ac8a6e373f2a2b249bde933ebeb
author Rune Lillesveen <rune@opera.com> Thu Oct 05 21:05:01 2017
committer Commit Bot <commit-bot@chromium.org> Thu Oct 05 21:05:01 2017
tree 3aedf6e84d3b4504723727ce32fc8f3bce237847
parent 679ae771d747c9192482fddd6d8e6df4770335fa

Don't update fragment anchor during DOM operations.

We tried to update the fragment anchor position immediately when all
script blocking sheets are removed. As part of that update we do a
style and layout update. The last script blocking sheet may be
removed as part of removing a style element from the DOM. Updating
style and layout in the middle of a DOM operation is not safe.

Instead, update the fragment anchor position during the next safe
lifecycle update. The crash was caused by Document still pointing to a
documentElement being removed while updating the style and layout tree,
but its parent pointer had already been set to null.

Bug: 771088
Change-Id: Iaaaeece23d795c2e41d31b9fb97fc795eb2b8305
Reviewed-on: https://chromium-review.googlesource.com/698305
Commit-Queue: Rune Lillesveen <rune@opera.com>
Reviewed-by: Steve Kobes <skobes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#506854}