| Log Message: |
Merge 159007 "Notify nodes removal to Range/Selection after disp..."
> Notify nodes removal to Range/Selection after dispatching blur and mutation event
>
> This patch changes notifying nodes removal to Range/Selection after dispatching blur and mutation event. In willRemoveChildren(), like willRemoveChild(); r115686 did same change, although it didn't change willRemoveChildren().
>
> The issue 295010, use-after-free, is caused by setting removed node to Selection in mutation event handler.
>
> BUG=295010
> TEST=LayoutTests/fast/dom/Range/range-created-during-remove-children.html, LayoutTests/editing/selection/selection-change-in-mutation-event-by-remove-children.html, LayoutTests/editing/selection/selection-change-in-blur-event-by-remove-children.html
> R=tkent@chromium.org
>
> Review URL: https://codereview.chromium.org/25389004
TBR=yosin@chromium.org
Review URL: https://codereview.chromium.org/30663003
|