angler-fishThe Vulnerability History Project

parserInsertBefore: Bail out if the parent no longer contains the child.

      nextChild may be removed from the DOM tree during the
|parserRemoveChild(*newChild)| call which triggers unload events of newChild's 
descendant iframes. In order to maintain the integrity of the DOM tree, the
insertion of newChild must be aborted in this case.

This patch adds a return statement that rectifies the behavior in this
edge case.

BUG=519558

Review URL: https://codereview.chromium.org/1283263002

git-svn-id: svn://svn.chromium.org/blink/trunk@200690 bbb929c8-8fbe-4397-9dbb-9b2b20218538
    
commit c71a21e6dda9025c2bf823c5aab791c2ae8cdfc2
-11
-30
-3
expand_less