Make TextIterator to stop when it falls to handle shadow tree

Make TextIterator to stop when it falls to handle shadow tree

The issue 521655 causes bad case in |toShadowRoot()| with a test script in
|TextIterator::advance()|. However, I could not get a HTML fragment causing
this situation since the test script generates HTML fragment and I could not
reproduce on my machines.

This patch changes |TextIterator| to stop when it fails to handle shadow tree
to avoid bad cast for preventing attacker to use this.

We'll add a test case for this once we have HTML fragment to cause this
bad cast.

BUG=521655
TEST=n/a; It is hard to create a test case for this issue

Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=200958

[yosin_UTC9, 2015-08-20 09:16:08]

yosin@chromium.org changed reviewers:
+ tkent@chromium.org

[yosin_UTC9, 2015-08-20 09:19:14]

PTAL

I think that rather than seeking HTML fragment to reproduce this issue, it takes
time, it is better to get rid of security hole.

[tkent, 2015-08-20 09:27:24]

lgtm.

The function is too large, and it looks very hard to make a unit test for this
issue.

[yosin_UTC9, 2015-08-20 09:38:17]

The CQ bit was checked by yosin@chromium.org

[commit-bot: I haz the power, 2015-08-20 09:38:27]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1293703006/1
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1293703006/1

[commit-bot: I haz the power, 2015-08-20 11:55:27]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2015-08-20 11:55:28]

Try jobs failed on following builders:
  win_chromium_x64_rel_ng on tryserver.chromium.win (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.win/builders/win_chromium_x64_...)

[yosin_UTC9, 2015-08-20 12:57:10]

The CQ bit was checked by yosin@chromium.org

[commit-bot: I haz the power, 2015-08-20 12:57:27]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1293703006/1
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1293703006/1

[commit-bot: I haz the power, 2015-08-20 17:51:20]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2015-08-20 17:51:20]

Try jobs failed on following builders:
  linux_android_rel_ng on tryserver.chromium.linux (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_android_r...)

[yosin_UTC9, 2015-08-21 01:51:47]

The CQ bit was checked by yosin@chromium.org

[commit-bot: I haz the power, 2015-08-21 01:52:29]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1293703006/1
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1293703006/1

[commit-bot: I haz the power, 2015-08-21 04:08:47]

Committed patchset #1 (id:1) as
https://src.chromium.org/viewvc/blink?view=rev&revision=200958