Postpone mutation event dispatch in Selection.deleteFromDocument

Source/core/page/DOMSelection.cpp

Index: Source/core/page/DOMSelection.cpp
diff --git a/Source/core/page/DOMSelection.cpp b/Source/core/page/DOMSelection.cpp
index 99c29c28c4001d42a10958fb1dfb1c8a0583d6e3..a123fce0c15e5baa4053c2de2e37c1dbd523e061 100644
--- a/Source/core/page/DOMSelection.cpp
+++ b/Source/core/page/DOMSelection.cpp
@@ -42,6 +42,7 @@
 #include "core/editing/FrameSelection.h"
 #include "core/editing/TextIterator.h"
 #include "core/editing/htmlediting.h"
+#include "core/events/ScopedEventQueue.h"
 #include "core/frame/LocalFrame.h"
 #include "wtf/text/WTFString.h"
 
@@ -456,7 +457,10 @@ void DOMSelection::deleteFromDocument()
     if (!selectedRange)
         return;
 
-    selectedRange->deleteContents(ASSERT_NO_EXCEPTION);
+    {
+        EventQueueScope eventQueueScope;

[Yuta Kitamura, 2014/03/19 06:57:52]

I think this should be done within Range::deleteContents().

[yosin_UTC9, 2014/03/19 07:33:35]

I agree with yutak@. |Range::deleteContents()| is also fragile against DOM
mutation event attack. I hope changing |Range::deleteContents()| doesn't make
failure on layout tests. Although, if some tests are failed, please update
tests.

+        selectedRange->deleteContents(ASSERT_NO_EXCEPTION);
+    }
 
     setBaseAndExtent(selectedRange->startContainer(ASSERT_NO_EXCEPTION), selectedRange->startOffset(), selectedRange->startContainer(), selectedRange->startOffset(), ASSERT_NO_EXCEPTION);
 }