Fix crash in ApplyStyleCommand::applyRelativeFontStyleChange()

Fix crash in ApplyStyleCommand::applyRelativeFontStyleChange()

Fix crash in ApplyStyleCommand::applyRelativeFontStyleChange(). The issue was
that we would traverse the DOM tree past the beyondEnd under some circumstances
and thus NodeTraversal::next() would return null unexpectedly. This CL adds a
check to make sure startNode != beyondEnd before traversing to avoid the
problem.

This CL also adds a few more assertions to catch similar issues more easily in
the future.

R=leviw@chromium.org, adamk
BUG=345950
TEST=editing/style/apply-style-crash2.html

Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=167845

[Inactive, 2014-02-25 15:00:41]

https://codereview.chromium.org/177093016/diff/1/Source/core/editing/ApplySty...
File Source/core/editing/ApplyStyleCommand.cpp (right):

https://codereview.chromium.org/177093016/diff/1/Source/core/editing/ApplySty...
Source/core/editing/ApplyStyleCommand.cpp:370: startNode =
NodeTraversal::next(*startNode);
This traverses past beyondEnd if startNode == beyondEnd.

[leviw_travelin_and_unemployed, 2014-02-25 18:45:35]

The code change lgtm. The test needs some work.

https://codereview.chromium.org/177093016/diff/1/LayoutTests/editing/style/ap...
File LayoutTests/editing/style/apply-style-crash2.html (right):

https://codereview.chromium.org/177093016/diff/1/LayoutTests/editing/style/ap...
LayoutTests/editing/style/apply-style-crash2.html:11:
"el0=document.createElement('input');",
This could be further minimized. Can you spend some time pairing this down?
(Remove the array and loop, etc.) Having it print "Test passes if no crash"
would also be good.

[Inactive, 2014-02-25 20:38:54]

https://codereview.chromium.org/177093016/diff/1/LayoutTests/editing/style/ap...
File LayoutTests/editing/style/apply-style-crash2.html (right):

https://codereview.chromium.org/177093016/diff/1/LayoutTests/editing/style/ap...
LayoutTests/editing/style/apply-style-crash2.html:11:
"el0=document.createElement('input');",
On 2014/02/25 18:45:36, Levi wrote:
> This could be further minimized. Can you spend some time pairing this down?
> (Remove the array and loop, etc.) Having it print "Test passes if no crash"
> would also be good.

Done. Please let me know if the test is good enough now.

[leviw_travelin_and_unemployed, 2014-02-25 21:06:14]

Totally better. Thank you :)

lgtm.

[Inactive, 2014-02-25 21:09:01]

The CQ bit was checked by ch.dumez@samsung.com

[commit-bot: I haz the power, 2014-02-25 21:09:06]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/ch.dumez@samsung.com/177093016/10001

[commit-bot: I haz the power, 2014-02-25 23:04:01]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/ch.dumez@samsung.com/177093016/10001

[commit-bot: I haz the power, 2014-02-25 23:23:30]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/ch.dumez@samsung.com/177093016/10001

[Inactive, 2014-02-26 02:30:24]

Committed patchset #2 manually as r167845 (presubmit successful).