Invalidate the previous caret even if the parent text node is removed.

third_party/WebKit/Source/core/editing/FrameSelection.cpp

 /*
  * Copyright (C) 2004, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 687 matching lines @@
         && newNode == m_previousCaretNode
         && newRect == m_previousCaretRect
         && caretVisibility() == m_previousCaretVisibility)
         return;
 
     LayoutView* view = m_frame->document()->layoutView();
     if (m_previousCaretNode && (shouldRepaintCaret(*m_previousCaretNode) || shouldRepaintCaret(view)))
         invalidateLocalCaretRect(m_previousCaretNode.get(), m_previousCaretRect);
     if (newNode && (shouldRepaintCaret(*newNode) || shouldRepaintCaret(view)))
         invalidateLocalCaretRect(newNode, newRect);
+    // Must invalidate |m_previousCaretNode| even if it's detached from its parent. crbug.com/528922
+    if (m_previousCaretNode && newNode && !m_previousCaretNode->parentNode())

[yosin_UTC9, 2016/02/02 01:56:56]

nit: s/!m_previousCaretNode->parentNode()/!m_previousCaretNode->inDocument()/
to handle detached tree which contains |m_previousCaretNode|.

[dshwang, 2016/02/02 14:58:45]

Done.

+        invalidateLocalCaretRect(newNode, m_previousCaretRect);

[yosin_UTC9, 2016/02/02 01:56:56]

This call seems to be wrong, since |m_previousCaretRect| is calculated from
|m_previousCaretNode|. |newNode| and |m_previousCaretNode| aren't related. In
the bug case, it is tightly related, |newNode| is formatted at |m_previousNode|.

[dshwang, 2016/02/02 14:58:45]

True. this code expects |newNode| is formatted at |m_previousNode|.

However, this bug is only case that |m_previousNode| is detached.
Let me explain why this case happens
1. when a user type characters, Blink creates a generated #text node belonging
to the input node. the caret node belongs to the generated #text node.
2. when a user delete all characters, the generated #text node is deleted and
Blink creates new caret node belonging to the input node.

You concern about user moving selection to other node. However, in the case,
|m_previousCaretNode| never be detached.

     m_previousCaretNode = newNode;
     m_previousCaretRect = newRect;
     m_previousCaretVisibility = caretVisibility();
 }
 
 void FrameSelection::paintCaret(GraphicsContext& context, const LayoutPoint& paintOffset)
 {
     if (selection().isCaret() && m_shouldPaintCaret) {
         updateCaretRect(PositionWithAffinity(selection().start(), selection().affinity()));
         CaretBase::paintCaret(selection().start().anchorNode(), context, paintOffset);
@@ skipping 693 matching lines @@
 
 void showTree(const blink::FrameSelection* sel)
 {
     if (sel)
         sel->showTreeForThis();
     else
         fprintf(stderr, "Cannot showTree for (nil) FrameSelection.\n");
 }
 
 #endif