Regression: ASSERT(!m_adoptionIsRequired) under Node::ref() on iOS Debug

https://bugs.webkit.org/show_bug.cgi?id=262764

Reviewed by Ryosuke Niwa.

With smart pointer adoption, it is really easy to ref a Node while it is
still being constructed. This is not harmful but this hits the
adoptionRequirement assertion in Node::ref().

To address the issue, I am relaxing the adoption requirement for Document
Nodes. We may want to extend this to more Node types in the future but
this is enough to address this particular crash.

* Source/WebCore/dom/Node.cpp:
(WebCore::Node::Node):
* Source/WebCore/dom/Node.h:
(WebCore::Node::relaxAdoptionRequirement):

Canonical link: https://commits.webkit.org/268983@main

Source/WebCore/dom/Node.cpp

@@ -398,6 +398,10 @@ Node::Node(Document& document, ConstructionType type)
 {
     ASSERT(isMainThread());
 
+    // Allow code to ref the Document while it is being constructed to make our life easier.
+    if (isDocumentNode())
+        relaxAdoptionRequirement();
+
     document.incrementReferencingNodeCount();
 
 #if !defined(NDEBUG) || DUMP_NODE_STATISTICS

Source/WebCore/dom/Node.h

@@ -530,6 +530,15 @@ class Node : public EventTarget {
     bool m_adoptionIsRequired { true };
 #endif
 
+    void relaxAdoptionRequirement()
+    {
+#if ASSERT_ENABLED
+        ASSERT_WITH_SECURITY_IMPLICATION(!m_deletionHasBegun);
+        ASSERT(m_adoptionIsRequired);
+        m_adoptionIsRequired = false;
+#endif
+    }
+
     HashMap<Ref<MutationObserver>, MutationRecordDeliveryOptions> registeredMutationObservers(MutationObserverOptionType, const QualifiedName* attributeName);
     void registerMutationObserver(MutationObserver&, MutationObserverOptions, const MemoryCompactLookupOnlyRobinHoodHashSet<AtomString>& attributeFilter);
     void unregisterMutationObserver(MutationObserverRegistration&);