Invalidate the previous caret even if the parent text node is removed.

third_party/WebKit/Source/core/editing/FrameSelection.cpp

Index: third_party/WebKit/Source/core/editing/FrameSelection.cpp
diff --git a/third_party/WebKit/Source/core/editing/FrameSelection.cpp b/third_party/WebKit/Source/core/editing/FrameSelection.cpp
index a648842505f763693a3dc2b41124900bb5cc3e1d..c7faeb663e28dafdf010feb8592c05aeafecba06 100644
--- a/third_party/WebKit/Source/core/editing/FrameSelection.cpp
+++ b/third_party/WebKit/Source/core/editing/FrameSelection.cpp
@@ -705,6 +705,9 @@ void FrameSelection::invalidateCaretRect()
         invalidateLocalCaretRect(m_previousCaretNode.get(), m_previousCaretRect);
     if (newNode && (shouldRepaintCaret(*newNode) || shouldRepaintCaret(view)))
         invalidateLocalCaretRect(newNode, newRect);
+    // Must invalidate |m_previousCaretNode| even if it's detached from its parent. crbug.com/528922
+    if (m_previousCaretNode && newNode && !m_previousCaretNode->parentNode())

[yosin_UTC9, 2016/02/02 01:56:56]

nit: s/!m_previousCaretNode->parentNode()/!m_previousCaretNode->inDocument()/
to handle detached tree which contains |m_previousCaretNode|.

[dshwang, 2016/02/02 14:58:45]

Done.

+        invalidateLocalCaretRect(newNode, m_previousCaretRect);

[yosin_UTC9, 2016/02/02 01:56:56]

This call seems to be wrong, since |m_previousCaretRect| is calculated from
|m_previousCaretNode|. |newNode| and |m_previousCaretNode| aren't related. In
the bug case, it is tightly related, |newNode| is formatted at |m_previousNode|.

[dshwang, 2016/02/02 14:58:45]

True. this code expects |newNode| is formatted at |m_previousNode|.

However, this bug is only case that |m_previousNode| is detached.
Let me explain why this case happens
1. when a user type characters, Blink creates a generated #text node belonging
to the input node. the caret node belongs to the generated #text node.
2. when a user delete all characters, the generated #text node is deleted and
Blink creates new caret node belonging to the input node.

You concern about user moving selection to other node. However, in the case,
|m_previousCaretNode| never be detached.

     m_previousCaretNode = newNode;
     m_previousCaretRect = newRect;
     m_previousCaretVisibility = caretVisibility();