Code: NodeIterator::NodeIterator(PassRefPtrWillBeRawPtr<Node> rootNode, unsigned whatToShow, PassRefPtrWillBeRawPtr<NodeFilter> filter)
     : NodeIteratorBase(rootNode, whatToShow, filter)
     , m_referenceNode(root(), true)
 {
    root()->document().attachNodeIterator(this);
 }

Vulnerability Type: DoS 
CWE ID: 
Summary: Use-after-free vulnerability in Blink, as used in Google Chrome before 49.0.2623.75, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
Commit Message: Fix detached Attr nodes interaction with NodeIterator

- Don't register NodeIterator to document when attaching to Attr node.
-- NodeIterator is registered to its document to receive updateForNodeRemoval notifications.
-- However it wouldn't make sense on Attr nodes, as they never have children.

BUG=572537

Review URL: https://codereview.chromium.org/1577213003

Cr-Commit-Position: refs/heads/master@{#369687}