Created attachment 209509 [details]
Patch

Comment on attachment 209509 [details]
Patch

Search for documentBeingDestroyed()

Created attachment 209539 [details]
Patch v2

Okay, give Document a flag for "render tree being ripped out LOL" mode.

Comment on attachment 209539 [details]
Patch v2

View in context: https://bugs.webkit.org/attachment.cgi?id=209539&action=review

> Source/WebCore/dom/Document.cpp:2038
> +    m_renderTreeBeingDestroyed = true;

maybe TemporaryChange<bool>?

Committed r154542: <http://trac.webkit.org/changeset/154542>

Comment on attachment 209539 [details]
Patch v2

View in context: https://bugs.webkit.org/attachment.cgi?id=209539&action=review

> Source/WebCore/dom/Document.cpp:483
> +    , m_renderTreeBeingDestroyed(false)

I would call this m_isDestroyingRenderTree as in “document is destroying render tree”.

> Source/WebCore/dom/Document.h:550
> +    bool renderTreeBeingDestroyed() const { return m_renderTreeBeingDestroyed; }

I would call this isDestroyingRenderTree() as in “document is destroying render tree”.

(In reply to comment #6)
> (From update of attachment 209539 [details])
> View in context: https://bugs.webkit.org/attachment.cgi?id=209539&action=review
> 
> > Source/WebCore/dom/Document.cpp:483
> > +    , m_renderTreeBeingDestroyed(false)
> 
> I would call this m_isDestroyingRenderTree as in “document is destroying render tree”.
> 
> > Source/WebCore/dom/Document.h:550
> > +    bool renderTreeBeingDestroyed() const { return m_renderTreeBeingDestroyed; }
> 
> I would call this isDestroyingRenderTree() as in “document is destroying render tree”.

Yeah, in retrospect that is a better name.
isDetachingRenderTree() is another alternative.