https://bugs.webkit.org/show_bug.cgi?id=93587
Node::replaceChild() can create bad DOM topology with MutationEvent, Part 2

Reviewed by Kent Tamura.

Source/WebCore:

This is a followup of r124156. replaceChild() has yet another hidden
MutationEvent trigger. This change added a guard for it.

Test: fast/events/mutation-during-replace-child-2.html

* dom/ContainerNode.cpp:
(WebCore::ContainerNode::replaceChild):

LayoutTests:

* fast/events/mutation-during-replace-child-2-expected.txt: Added.
* fast/events/mutation-during-replace-child-2.html: Added.

git-svn-id: svn://svn.chromium.org/blink/trunk@125237 bbb929c8-8fbe-4397-9dbb-9b2b20218538
static void willRemoveChild(Node* child)
{
#if ENABLE(MUTATION_OBSERVERS)
    ASSERT(child->parentNode());
    ChildListMutationScope(child->parentNode()).willRemoveChild(child);
    child->notifyMutationObserversNodeWillDetach();
#endif

    dispatchChildRemovalEvents(child);
    child->document()->nodeWillBeRemoved(child); // e.g. mutation event listener can create a new range.
    ChildFrameDisconnector(child).disconnect();
}

static void willRemoveChild(Node* child)
{
#if ENABLE(MUTATION_OBSERVERS)
    ASSERT(child->parentNode());
    ChildListMutationScope(child->parentNode()).willRemoveChild(child);
    child->notifyMutationObserversNodeWillDetach();
#endif

    dispatchChildRemovalEvents(child);
    child->document()->nodeWillBeRemoved(child); // e.g. mutation event listener can create a new range.
    ChildFrameDisconnector(child).disconnect();
}
