Fix invalid isInShadowRoot flag during input element removal

https://bugs.webkit.org/show_bug.cgi?id=241470

Reviewed by Ryosuke Niwa.

Style invalidation of input elements might rely on whether the element
is in the shadow tree, but during node removal the isInShadowRoot flag
might not be up-to-date. Ensure that the flag is updated by
letting Node::removedFromAncestor() be called up first in the
HTMLInputNode::removedFromAncestor() implementation, before
doing anything else with the node post-removal.

* Source/WebCore/html/HTMLInputElement.cpp:
(WebCore::HTMLInputElement::removedFromAncestor):

Canonical link: https://commits.webkit.org/251442@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@295436 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/WebCore/html/HTMLInputElement.cpp

@@ -1585,6 +1585,7 @@ void HTMLInputElement::didFinishInsertingNode()
 
 void HTMLInputElement::removedFromAncestor(RemovalType removalType, ContainerNode& oldParentOfRemovedTree)
 {
+    HTMLTextFormControlElement::removedFromAncestor(removalType, oldParentOfRemovedTree);
     if (removalType.treeScopeChanged && isRadioButton())
         oldParentOfRemovedTree.treeScope().radioButtonGroups().removeButton(*this);
     if (removalType.disconnectedFromDocument && !form())
@@ -1593,7 +1594,6 @@ void HTMLInputElement::removedFromAncestor(RemovalType removalType, ContainerNod
         document().removeElementWithPendingUserAgentShadowTreeUpdate(*this);
         m_hasPendingUserAgentShadowTreeUpdate = false;
     }
-    HTMLTextFormControlElement::removedFromAncestor(removalType, oldParentOfRemovedTree);
     ASSERT(!isConnected());
     if (removalType.disconnectedFromDocument && !form() && isRadioButton())
         updateValidity();