If the document element has a lang attribute and it is removed from its parent document node, we can hit the assertion in Element::updateEffectiveLangStateFromParent that checks we don't have a lang attribute.  This is because Element::removedFromAncestor checks that the element doesn't have effective lang state before calling updateEffectiveLangStateFromParent(), with the understanding that "no effective lang state" means the element is in the common case of inheriting the document element lang state directly, i.e. there's no intervening ancestor with a lang attribute at all.

Additionally, we don't correctly handle updating the document element language when the document element is removed or replaced.  (We only update the document element language when the lang attribute on a current document element is changed.)