Invalidate the previous caret location when editing text nodes.

third_party/WebKit/Source/core/dom/CharacterData.cpp

Index: third_party/WebKit/Source/core/dom/CharacterData.cpp
diff --git a/third_party/WebKit/Source/core/dom/CharacterData.cpp b/third_party/WebKit/Source/core/dom/CharacterData.cpp
index a9ab5e34caaa358c846824a725e62aa88bc512f9..1f0cbf6b96c5a96dcebce6d7cb4be3595da423ed 100644
--- a/third_party/WebKit/Source/core/dom/CharacterData.cpp
+++ b/third_party/WebKit/Source/core/dom/CharacterData.cpp
@@ -42,6 +42,8 @@ void CharacterData::atomize()
 
 void CharacterData::setData(const String& data)
 {
+    document().dataWillChange(*this);

[yosin_UTC9, 2016/04/28 01:50:28]

At glance, calling |dataWillChange()| is enough in |setDataAnUpdate()|.

Why do we need to call |dataWillChange()| for |m_data === nonNullData| case?
Is this root cause of this bug?

[chrishtr, 2016/04/28 17:22:01]

setData() is an indepenent call site, no?
Done. Also noticed that there is no early-out logic in setDataAndUpdate. I'll
try that in a followup patch.
The root cause is that if a text node is inserted by script (and not an editing
command), and then the last character of the text is deleted, the text node's
layout object
will be eagerly deleted in updateTextLayoutObject. Thus FrameSelection doesn't
have a hook to invalidate the old caret location before its old location becomes
unknown.

+
     const String& nonNullData = !data.isNull() ? data : emptyString();
     if (m_data == nonNullData)
         return;
@@ -159,6 +161,8 @@ void CharacterData::setNodeValue(const String& nodeValue)
 
 void CharacterData::setDataAndUpdate(const String& newData, unsigned offsetOfReplacedData, unsigned oldLength, unsigned newLength, UpdateSource source, RecalcStyleBehavior recalcStyleBehavior)
 {
+    document().dataWillChange(*this);

[yosin_UTC9, 2016/04/28 01:50:28]

Should we call this for |source != UpdateFromParser| for paring with
|didUpdateCharacterData()| call?

[chrishtr, 2016/04/28 17:22:02]

Done.

+
     String oldData = m_data;
     m_data = newData;