ASSERTION FAILED: !attached() in Node::attach.

ASSERTION FAILED: !attached() in Node::attach.
https://bugs.webkit.org/show_bug.cgi?id=80726

Reviewed by Adam Barth.

Source/WebCore:

While parsing XML document, prevent attaching the leaf text node
back to document, if its parent is not attached.

Test: fast/dom/text-node-attach-crash.xhtml

* xml/parser/XMLDocumentParser.cpp:
(WebCore::XMLDocumentParser::exitText):

LayoutTests:

* fast/dom/text-node-attach-crash-expected.txt: Added.
* fast/dom/text-node-attach-crash.xhtml: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@113670 268f45cc-cd09-0410-ab3c-d52691b4dbfc