Source/WebCore: ASSERT(!eventDispatchForbidden()) fires when removed plugin re-inserted as part of readyStateChange.
https://bugs.webkit.org/show_bug.cgi?id=93639

Reviewed by Ryosuke Niwa.

Removing a plugin causes a detach which can cancel the last remaining load on a page,
resulting in a readyStateChange event during a time when things are inconsisent. Defer
the detach which triggers this chain of events until after the node is fully removed
from the document's elementsById map.

Test: plugins/plugin-remove-readystatechange.html

* dom/ContainerNode.cpp:
(WebCore::ContainerNode::removeChild):
(WebCore::ContainerNode::removeChildren):

LayoutTests: ASSERT(!eventDispatchForbidden()) firest when removed plugin re-inserted as part of readyStateChange.
https://bugs.webkit.org/show_bug.cgi?id=93639

Reviewed by Ryosuke Niwa.

Add a new testcase to cover this issue.  Test passes if assert doesn't fire in debug builds.

* plugins/plugin-remove-readystatechange-expected.txt: Added.
* plugins/plugin-remove-readystatechange.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@128524 268f45cc-cd09-0410-ab3c-d52691b4dbfc