Change ContanerNode::RemoveChild() to allow ChildrenChanged() to use flat tree

This patch changes call site of |ChildrenChanged()| in |ContanerNode::
RemoveChild()| out side of |SlotAssignmentRecalcForbiddenScope| to allow
|ChildrenChanged()| to use flat tree.

Background:
|HTMLElement::ChildrenChanged()| adjust directionality of element, e.g.
"dir" attirbute, <bdi>, <bdo>, etc, by traversing flat tree.

Bug: 867355
Change-Id: I8e1211f1a43afc27ba0e582030f2f2e8a6a74731
Reviewed-on: https://chromium-review.googlesource.com/1152754Reviewed-by: Hayato Ito <hayato@chromium.org>
Commit-Queue: Yoshifumi Inoue <yosin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#579000}

third_party/blink/renderer/core/BUILD.gn

@@ -1853,6 +1853,7 @@ jumbo_source_set("unit_tests") {
     "html/forms/type_ahead_test.cc",
     "html/html_content_element_test.cc",
     "html/html_dimension_test.cc",
+    "html/html_element_test.cc",
     "html/html_embed_element_test.cc",
     "html/html_frame_element_test.cc",
     "html/html_iframe_element_test.cc",

third_party/blink/renderer/core/dom/container_node.cc

@@ -700,14 +700,15 @@ Node* ContainerNode::RemoveChild(Node* old_child,
   }
 
   {
-    SlotAssignmentRecalcForbiddenScope forbid_slot_recalc(GetDocument());
     HTMLFrameOwnerElement::PluginDisposeSuspendScope suspend_plugin_dispose;
     TreeOrderedMap::RemoveScope tree_remove_scope;
-
     Node* prev = child->previousSibling();
     Node* next = child->nextSibling();
-    RemoveBetween(prev, next, *child);
-    NotifyNodeRemoved(*child);
+    {
+      SlotAssignmentRecalcForbiddenScope forbid_slot_recalc(GetDocument());
+      RemoveBetween(prev, next, *child);
+      NotifyNodeRemoved(*child);
+    }
     ChildrenChanged(ChildrenChange::ForRemoval(*child, prev, next,
                                                kChildrenChangeSourceAPI));
   }

third_party/blink/renderer/core/html/html_element_test.cc

+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "third_party/blink/renderer/core/html/html_element.h"
+
+#include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/blink/renderer/core/testing/page_test_base.h"
+
+namespace blink {
+
+class HTMLElementTest : public PageTestBase {};
+
+TEST_F(HTMLElementTest, AdjustDirectionalityInFlatTree) {
+  SetBodyContent("<bdi><summary><i id=target></i></summary></bdi>");
+  UpdateAllLifecyclePhases();
+  GetDocument().getElementById("target")->remove();
+  // Pass if not crashed.
+}
+
+}  // namespace blink