parserInsertBefore and parserRemoveChild should check newChild for a parent.

      parserRemoveChild can run script in obscure cases involving the adoption
agency changing the children of a script element, this script can then
move the element the parser is trying to insert back into the page so that
parserInsertBefore would then insert the newChild in the tree again. This
means the child ends up being inserted twice which can result in a use
after free if one is removed and a GC happens.

To fix this we run the removal in a loop inside the insert methods until
the child really is removed. We probably want to file a spec bug about this
too.

BUG=478745

Review URL: https://codereview.chromium.org/1117973003

git-svn-id: svn://svn.chromium.org/blink/trunk@194835 bbb929c8-8fbe-4397-9dbb-9b2b20218538