Invalidate the previous caret even if the parent text node is removed.

third_party/WebKit/Source/core/editing/FrameSelection.cpp

 /*
  * Copyright (C) 2004, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 77 matching lines @@
 static inline bool shouldAlwaysUseDirectionalSelection(LocalFrame* frame)
 {
     return !frame || frame->editor().behavior().shouldConsiderSelectionAsDirectional();
 }
 
 FrameSelection::FrameSelection(LocalFrame* frame)
     : m_frame(frame)
     , m_pendingSelection(PendingSelection::create(*this))
     , m_selectionEditor(SelectionEditor::create(*this))
     , m_granularity(CharacterGranularity)
+    , m_parentOfPreviousCaretNode(nullptr)
     , m_previousCaretVisibility(Hidden)
     , m_caretBlinkTimer(this, &FrameSelection::caretBlinkTimerFired)
     , m_caretRectDirty(true)
     , m_shouldPaintCaret(true)
     , m_isCaretBlinkingSuspended(false)
     , m_focused(frame && frame->page() && frame->page()->focusController().focusedFrame() == frame)
     , m_shouldShowBlockCursor(false)
 {
     if (shouldAlwaysUseDirectionalSelection(m_frame))
         m_selectionEditor->setIsDirectional(true);
@@ skipping 519 matching lines @@
 
     m_caretBlinkTimer.stop();
 
     LayoutView* view = m_frame->contentLayoutObject();
     if (view)
         view->clearSelection();
 
     setSelection(VisibleSelection(), CloseTyping | ClearTypingStyle | DoNotUpdateAppearance);
     m_selectionEditor->dispose();
     m_previousCaretNode.clear();
+    m_parentOfPreviousCaretNode = nullptr;
 }
 
 void FrameSelection::setStart(const VisiblePosition &pos, EUserTriggered trigger)
 {
     if (selection().isBaseFirst())
         setBase(pos, trigger);
     else
         setExtent(pos, trigger);
 }
 
@@ skipping 63 matching lines @@
         && newNode == m_previousCaretNode
         && newRect == m_previousCaretRect
         && caretVisibility() == m_previousCaretVisibility)
         return;
 
     LayoutView* view = m_frame->document()->layoutView();
     if (m_previousCaretNode && (shouldRepaintCaret(*m_previousCaretNode) || shouldRepaintCaret(view)))
         invalidateLocalCaretRect(m_previousCaretNode.get(), m_previousCaretRect);
     if (newNode && (shouldRepaintCaret(*newNode) || shouldRepaintCaret(view)))
         invalidateLocalCaretRect(newNode, newRect);
+    // Must invalidate #text even if it's detached. crbug.com/528922
+    if (m_previousCaretNode && newNode == m_parentOfPreviousCaretNode && !m_previousCaretNode->inDocument())

[yosin_UTC9, 2016/02/05 04:04:48]

This condition isn't enough, e.g. 
 - ancestor of |m_previousCaretNode| can be detached from document.
 - |m_previousCaretNode| can be move into another tree location.

I don't think this approach is good.

+        invalidateLocalCaretRect(newNode, m_previousCaretRect);
     m_previousCaretNode = newNode;
+    if (newNode)
+        m_parentOfPreviousCaretNode = newNode->parentNode();
     m_previousCaretRect = newRect;
     m_previousCaretVisibility = caretVisibility();
 }
 
 void FrameSelection::paintCaret(GraphicsContext& context, const LayoutPoint& paintOffset)
 {
     if (selection().isCaret() && m_shouldPaintCaret) {
         updateCaretRect(PositionWithAffinity(selection().start(), selection().affinity()));
         CaretBase::paintCaret(selection().start().anchorNode(), context, paintOffset);
     }
@@ skipping 693 matching lines @@
 
 void showTree(const blink::FrameSelection* sel)
 {
     if (sel)
         sel->showTreeForThis();
     else
         fprintf(stderr, "Cannot showTree for (nil) FrameSelection.\n");
 }
 
 #endif