Make SelectionEditor::setWithoutValidation() not to use obsoleted layout objects

Make  SelectionEditor::setWithoutValidation() not to use obsoleted layout objects

Before this patch, |SelectionEditor::setWithoutValidation()| calls
|adjustVisibleSelectionInComposedTree()| to update composed tree version of
selection from DOM position. In |adjustVisibleSelectionInComposedTree()|, it
uses layout object in |mostBackwaredCaretPosition()| without updating layout
tree, via |VisibleSelection::computeSelectionType()|.

When |SelectionEditor::setWithoutValidation()| is called during DOM mutation,
e.g. |nodeWillBeRemove()|, Blink uses obsoleted layout object and it is not
safe.

This patch fixes above situation to make
|SelectionEditor::setWithoutValidation()| to call
|VisibleSelectionInComposedTree::setWithoutValidation()|.

BUG=561488
TEST=n/a; it is hard to write a test case, since obsoleted layout object is
still alive and there is no way to know obsoleted layout object.

Committed: https://crrev.com/b1d4fb057bdf2189888d502c47ba901f5d5da247
Cr-Commit-Position: refs/heads/master@{#362100}

[yosin_UTC9, 2015-11-27 09:57:52]

Description was changed from

==========
2015-11-27T16:50:02

BUG=561488
==========

to

==========
Make  SelectionEditor::setWithoutValidation() not to use obsoleted layout
objects

Before this patch, |SelectionEditor::setWithoutValidation()| calls
|adjustVisibleSelectionInComposedTree()| to update composed tree version of
selection from DOM position. In |adjustVisibleSelectionInComposedTree()|, it
uses layout object in |mostBackwaredCaretPosition()| without updating layout
tree, via |VisibleSelection::computeSelectionType()|.

When |SelectionEditor::setWithoutValidation()| is called during DOM mutation,
e.g. |nodeWillBeRemove()|, Blink uses obsoleted layout object and it is not
safe.

This patch fixes above situation to make
|SelectionEditor::setWithoutValidation()| to call
|VisibleSelectionInComposedTree::setWithoutValidation()|.

BUG=561488
TEST=n/a; it is hard to write a test case, since obsoleted layout object is
still alive and there is no way to know obsoleted layout object.
==========

[yosin_UTC9, 2015-11-27 09:57:52]

yosin@chromium.org changed reviewers:
+ hajimehoshi@chromium.org, yoichio@chromium.org

[yosin_UTC9, 2015-11-27 09:58:56]

PTAL

This is a part of fixing P1 bug crbug.com/561488 (heap-buffer-overflow)

[hajimehoshi, 2015-11-27 11:41:16]

lgtm

[yosin_UTC9, 2015-11-27 13:23:03]

The CQ bit was checked by yosin@chromium.org

[commit-bot: I haz the power, 2015-11-27 13:23:46]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1477313003/20001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1477313003/20001

[commit-bot: I haz the power, 2015-11-27 14:21:27]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2015-11-27 14:21:28]

Try jobs failed on following builders:
  linux_chromium_rel_ng on tryserver.chromium.linux (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_...)

[yosin_UTC9, 2015-11-30 01:47:03]

The CQ bit was checked by yosin@chromium.org

[yosin_UTC9, 2015-11-30 01:47:04]

The patchset sent to the CQ was uploaded after l-g-t-m from
hajimehoshi@chromium.org
Link to the patchset: https://codereview.chromium.org/1477313003/#ps40001
(title: "2015-11-30T10:45:57")

[commit-bot: I haz the power, 2015-11-30 01:47:31]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1477313003/40001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1477313003/40001

[commit-bot: I haz the power, 2015-11-30 04:21:10]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2015-11-30 04:21:11]

Try jobs failed on following builders:
  linux_android_rel_ng on tryserver.chromium.linux (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_android_r...)

[yosin_UTC9, 2015-11-30 04:28:25]

The CQ bit was checked by yosin@chromium.org

[commit-bot: I haz the power, 2015-11-30 04:28:36]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1477313003/40001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1477313003/40001

[commit-bot: I haz the power, 2015-11-30 07:09:41]

Committed patchset #3 (id:40001)

[commit-bot: I haz the power, 2015-11-30 07:10:36]

Description was changed from

==========
Make  SelectionEditor::setWithoutValidation() not to use obsoleted layout
objects

Before this patch, |SelectionEditor::setWithoutValidation()| calls
|adjustVisibleSelectionInComposedTree()| to update composed tree version of
selection from DOM position. In |adjustVisibleSelectionInComposedTree()|, it
uses layout object in |mostBackwaredCaretPosition()| without updating layout
tree, via |VisibleSelection::computeSelectionType()|.

When |SelectionEditor::setWithoutValidation()| is called during DOM mutation,
e.g. |nodeWillBeRemove()|, Blink uses obsoleted layout object and it is not
safe.

This patch fixes above situation to make
|SelectionEditor::setWithoutValidation()| to call
|VisibleSelectionInComposedTree::setWithoutValidation()|.

BUG=561488
TEST=n/a; it is hard to write a test case, since obsoleted layout object is
still alive and there is no way to know obsoleted layout object.
==========

to

==========
Make  SelectionEditor::setWithoutValidation() not to use obsoleted layout
objects

Before this patch, |SelectionEditor::setWithoutValidation()| calls
|adjustVisibleSelectionInComposedTree()| to update composed tree version of
selection from DOM position. In |adjustVisibleSelectionInComposedTree()|, it
uses layout object in |mostBackwaredCaretPosition()| without updating layout
tree, via |VisibleSelection::computeSelectionType()|.

When |SelectionEditor::setWithoutValidation()| is called during DOM mutation,
e.g. |nodeWillBeRemove()|, Blink uses obsoleted layout object and it is not
safe.

This patch fixes above situation to make
|SelectionEditor::setWithoutValidation()| to call
|VisibleSelectionInComposedTree::setWithoutValidation()|.

BUG=561488
TEST=n/a; it is hard to write a test case, since obsoleted layout object is
still alive and there is no way to know obsoleted layout object.

Committed: https://crrev.com/b1d4fb057bdf2189888d502c47ba901f5d5da247
Cr-Commit-Position: refs/heads/master@{#362100}
==========

[commit-bot: I haz the power, 2015-11-30 07:10:37]

Patchset 3 (id:??) landed as
https://crrev.com/b1d4fb057bdf2189888d502c47ba901f5d5da247
Cr-Commit-Position: refs/heads/master@{#362100}