https://bugs.webkit.org/show_bug.cgi?id=124145

Source/WebCore: 

Reviewed by Anders Carlsson.
        
Mutation during traversal invalidates the position cache. After the mid-point we start
traversing backwards as it the shortest path. However backward traversal of children-only
HTMLCollection was wrong and would end up going to descendants.
        
Reduction by yannick.poirier@inverto.tv.

Test: fast/dom/htmlcollection-children-mutation.html

* html/HTMLCollection.cpp:
(WebCore::HTMLCollection::collectionTraverseBackward):
        
    Traverse direct children only when m_shouldOnlyIncludeDirectChildren bit is set.

LayoutTests: 

Reviewed by Anders Carlsson.

* fast/dom/htmlcollection-children-mutation-expected.txt: Added.
* fast/dom/htmlcollection-children-mutation.html: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@159389 268f45cc-cd09-0410-ab3c-d52691b4dbfc