Cherry-pick(s) 2e63eaf64497. rdar://191051699 - #78737

Use-after-free in reused inner/outerHTML DocumentFragment
https://bugs.webkit.org/show_bug.cgi?id=322242
rdar://183463022

Reviewed by Wenson Hsieh.

The setters of innerHTML and outerHTML re-uses the same document fragment for parsing purposes
as a performance optimization. There is a further performance optimization in
ContainerNode::removeAllChildrenWithScriptAssertion to avoid calling Node::removingSteps on the
freshly parsed DOM tree under the document fragment for innerHTML and outerHTML. This leaves
Node::m_shadowIncludingRoot to remain pointing to the document fragment even after they had
logically been removed from the fragment.

This is ordinarily fine because the newly parsed DOM tree gets inserted into the context object
of innerHTML and outerHTML right away so insertionSteps will update Node::m_shadowIncludingRoot.

However, when a XML parser encounters a parsing error, it pauses the process midway and exit
early before Element::setOuterHTML had a chance to insert the new DOM tree to the context object.
If XML parser had constructed any custom elements by that point, those constructors will still
get called while the elements are a part of the reused document fragment, exposing it to scripts.

When script then removes the node from the document fragment, the performance optimization to
avoid calling Node::removingSteps in ContainerNode::removeAllChildrenWithScriptAssertion kicks in
and leaves DOM tree in an inconsistent state with a stale pointer in Node::m_shadowIncludingRoot.

Fix the bug by disabling the document fragment reuse when parsing XML. XML parser isn't optimized
for performance anyway.

Test: fast/dom/xml-parser-error-during-inner-outer-html-crash.html

* LayoutTests/fast/dom/xml-parser-error-during-inner-outer-html-crash-expected.txt: Added.
* LayoutTests/fast/dom/xml-parser-error-during-inner-outer-html-crash.html: Added.
* Source/WebCore/editing/markup.cpp:
(WebCore::createFragmentForMarkup):

Originally-landed-as: 316606.427@safari-7625-branch (2e63eaf64497). rdar://191051699