Clear TemplateContentDocumentFragment::m_host when HTMLTemplateElement is destroyed

Note that the included test only crashes reliably in an asan build.

R=inferno@chromium.org
BUG=286975

Review URL: https://chromiumcodereview.appspot.com/23708025

git-svn-id: svn://svn.chromium.org/blink/trunk@157543 bbb929c8-8fbe-4397-9dbb-9b2b20218538