Handle owner state change in HTMLLinkElement::setCSSStyleSheet

imported/web-platform-tests/shadow-dom/shadow-trees/upper-bounary-encapsulation/test-011.html
caused a flaky crashes on trybots.

When an link element started fetching CSS resource the resource loading happens asynchronously in the background, and
when it completes, owner element's state may have changed.

In the test, the owner element moved under shadow tree,
then asserting condition
ASSERT(!linkStyle() || !linkStyle()->hasSheet()).
happened.

BUG=503445
TEST=imported/web-platform-tests/shadow-dom/shadow-trees/upper-boundary-encapusulation/test-011.html

Review URL: https://codereview.chromium.org/1285413002

git-svn-id: svn://svn.chromium.org/blink/trunk@201752 bbb929c8-8fbe-4397-9dbb-9b2b20218538

third_party/WebKit/Source/core/html/HTMLLinkElement.cpp

@@ -518,7 +518,15 @@ void LinkStyle::setCSSStyleSheet(const String& href, const KURL& baseURL, const
         notifyLoadedSheetAndAllCriticalSubresources(Node::ErrorOccurredLoadingSubresource);
         return;
     }
-
+    // While the stylesheet is asynchronously loading, the owner can be moved under
+    // shadow tree.  In that case, cancel any processing on the loaded content.
+    if (m_owner->isInShadowTree()) {
+        m_loading = false;
+        removePendingSheet();
+        if (m_sheet)
+            clearSheet();
+        return;
+    }
     // Completing the sheet load may cause scripts to execute.
     RefPtrWillBeRawPtr<Node> protector(m_owner.get());