Revert of Make previousLinePosition() not to use dangling RootInlineBox

Revert of Make previousLinePosition() not to use dangling RootInlineBox (patchset #1 id:1 of https://codereview.chromium.org/2082893005/ )

Reason for revert:
New test editing/selection/modify_move/move_backward_line_import_crash.html fails on WebKit Linux MSAN.

Dashboard:
https://test-results.appspot.com/dashboards/flakiness_dashboard.html#tests=editing%2Fselection%2Fmodify_move%2Fmove_backward_line_import_crash.html&testType=webkit_tests

First failed build:
https://build.chromium.org/p/chromium.webkit/builders/WebKit%20Linux%20MSAN/builds/10718

Original issue's description:
> Make previousLinePosition() not to use dangling RootInlineBox
>
> This patch makes |previousLinePosition()| not to use dangling |RootInlineBox|
> pointer to avoid use-after-free.
>
> Before this patch, |isEditablePosition()| is called with |DoUpdateStyle|
> parameter to update layout tree if needed. Usually, layout tree isn't updated
> by this |isEditablePosition()| call since |previousLinePosition()| updates
> layout tree at entry. However, if there are pending style sheet, e.g. @import
> directive, and HTML import, e.g link rel=import, layout tree is updated since
> document isn't rendering ready, |haveImportLoaded()| &&
> |haveRenderBlockingStyleSheetsLoaded()|.
>
> BUG=618237
> TEST=LayoutTests/editing/selection/modify_move/move_backward_line_import_crash.html
>
> Committed: https://crrev.com/fb81c66590538c2487a34b8623066a22d0b27dff
> Cr-Commit-Position: refs/heads/master@{#401231}

TBR=yoichio@chromium.org,yosin@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=618237
Committed: https://crrev.com/f60b4eb00abc12a1fa2575890f7c77b373a1bedc
Cr-Commit-Position: refs/heads/master@{#401319}

[dgozman, 2016-06-22 17:08:53]

The CQ bit was checked by dgozman@chromium.org

[dgozman, 2016-06-22 17:08:54]

Created Revert of Make previousLinePosition() not to use dangling RootInlineBox

[commit-bot: I haz the power, 2016-06-22 17:09:26]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/2084913005/1

[commit-bot: I haz the power, 2016-06-22 17:11:10]

Description was changed from

==========
Revert of Make previousLinePosition() not to use dangling RootInlineBox
(patchset #1 id:1 of https://codereview.chromium.org/2082893005/ )

Reason for revert:
New test editing/selection/modify_move/move_backward_line_import_crash.html
fails on WebKit Linux MSAN.

Dashboard:
https://test-results.appspot.com/dashboards/flakiness_dashboard.html#tests=ed...

First failed build:
https://build.chromium.org/p/chromium.webkit/builders/WebKit%20Linux%20MSAN/b...

Original issue's description:
> Make previousLinePosition() not to use dangling RootInlineBox
> 
> This patch makes |previousLinePosition()| not to use dangling |RootInlineBox|
> pointer to avoid use-after-free.
> 
> Before this patch, |isEditablePosition()| is called with |DoUpdateStyle|
> parameter to update layout tree if needed. Usually, layout tree isn't updated
> by this |isEditablePosition()| call since |previousLinePosition()| updates
> layout tree at entry. However, if there are pending style sheet, e.g. @import
> directive, and HTML import, e.g link rel=import, layout tree is updated since
> document isn't rendering ready, |haveImportLoaded()| &&
> |haveRenderBlockingStyleSheetsLoaded()|.
> 
> BUG=618237
>
TEST=LayoutTests/editing/selection/modify_move/move_backward_line_import_crash.html
> 
> Committed: https://crrev.com/fb81c66590538c2487a34b8623066a22d0b27dff
> Cr-Commit-Position: refs/heads/master@{#401231}

TBR=yoichio@chromium.org,yosin@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=618237
==========

to

==========
Revert of Make previousLinePosition() not to use dangling RootInlineBox
(patchset #1 id:1 of https://codereview.chromium.org/2082893005/ )

Reason for revert:
New test editing/selection/modify_move/move_backward_line_import_crash.html
fails on WebKit Linux MSAN.

Dashboard:
https://test-results.appspot.com/dashboards/flakiness_dashboard.html#tests=ed...

First failed build:
https://build.chromium.org/p/chromium.webkit/builders/WebKit%20Linux%20MSAN/b...

Original issue's description:
> Make previousLinePosition() not to use dangling RootInlineBox
> 
> This patch makes |previousLinePosition()| not to use dangling |RootInlineBox|
> pointer to avoid use-after-free.
> 
> Before this patch, |isEditablePosition()| is called with |DoUpdateStyle|
> parameter to update layout tree if needed. Usually, layout tree isn't updated
> by this |isEditablePosition()| call since |previousLinePosition()| updates
> layout tree at entry. However, if there are pending style sheet, e.g. @import
> directive, and HTML import, e.g link rel=import, layout tree is updated since
> document isn't rendering ready, |haveImportLoaded()| &&
> |haveRenderBlockingStyleSheetsLoaded()|.
> 
> BUG=618237
>
TEST=LayoutTests/editing/selection/modify_move/move_backward_line_import_crash.html
> 
> Committed: https://crrev.com/fb81c66590538c2487a34b8623066a22d0b27dff
> Cr-Commit-Position: refs/heads/master@{#401231}

TBR=yoichio@chromium.org,yosin@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=618237
==========

[commit-bot: I haz the power, 2016-06-22 17:11:11]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2016-06-22 17:13:40]

Description was changed from

==========
Revert of Make previousLinePosition() not to use dangling RootInlineBox
(patchset #1 id:1 of https://codereview.chromium.org/2082893005/ )

Reason for revert:
New test editing/selection/modify_move/move_backward_line_import_crash.html
fails on WebKit Linux MSAN.

Dashboard:
https://test-results.appspot.com/dashboards/flakiness_dashboard.html#tests=ed...

First failed build:
https://build.chromium.org/p/chromium.webkit/builders/WebKit%20Linux%20MSAN/b...

Original issue's description:
> Make previousLinePosition() not to use dangling RootInlineBox
> 
> This patch makes |previousLinePosition()| not to use dangling |RootInlineBox|
> pointer to avoid use-after-free.
> 
> Before this patch, |isEditablePosition()| is called with |DoUpdateStyle|
> parameter to update layout tree if needed. Usually, layout tree isn't updated
> by this |isEditablePosition()| call since |previousLinePosition()| updates
> layout tree at entry. However, if there are pending style sheet, e.g. @import
> directive, and HTML import, e.g link rel=import, layout tree is updated since
> document isn't rendering ready, |haveImportLoaded()| &&
> |haveRenderBlockingStyleSheetsLoaded()|.
> 
> BUG=618237
>
TEST=LayoutTests/editing/selection/modify_move/move_backward_line_import_crash.html
> 
> Committed: https://crrev.com/fb81c66590538c2487a34b8623066a22d0b27dff
> Cr-Commit-Position: refs/heads/master@{#401231}

TBR=yoichio@chromium.org,yosin@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=618237
==========

to

==========
Revert of Make previousLinePosition() not to use dangling RootInlineBox
(patchset #1 id:1 of https://codereview.chromium.org/2082893005/ )

Reason for revert:
New test editing/selection/modify_move/move_backward_line_import_crash.html
fails on WebKit Linux MSAN.

Dashboard:
https://test-results.appspot.com/dashboards/flakiness_dashboard.html#tests=ed...

First failed build:
https://build.chromium.org/p/chromium.webkit/builders/WebKit%20Linux%20MSAN/b...

Original issue's description:
> Make previousLinePosition() not to use dangling RootInlineBox
>
> This patch makes |previousLinePosition()| not to use dangling |RootInlineBox|
> pointer to avoid use-after-free.
>
> Before this patch, |isEditablePosition()| is called with |DoUpdateStyle|
> parameter to update layout tree if needed. Usually, layout tree isn't updated
> by this |isEditablePosition()| call since |previousLinePosition()| updates
> layout tree at entry. However, if there are pending style sheet, e.g. @import
> directive, and HTML import, e.g link rel=import, layout tree is updated since
> document isn't rendering ready, |haveImportLoaded()| &&
> |haveRenderBlockingStyleSheetsLoaded()|.
>
> BUG=618237
>
TEST=LayoutTests/editing/selection/modify_move/move_backward_line_import_crash.html
>
> Committed: https://crrev.com/fb81c66590538c2487a34b8623066a22d0b27dff
> Cr-Commit-Position: refs/heads/master@{#401231}

TBR=yoichio@chromium.org,yosin@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=618237

Committed: https://crrev.com/f60b4eb00abc12a1fa2575890f7c77b373a1bedc
Cr-Commit-Position: refs/heads/master@{#401319}
==========

[commit-bot: I haz the power, 2016-06-22 17:13:41]

Patchset 1 (id:??) landed as
https://crrev.com/f60b4eb00abc12a1fa2575890f7c77b373a1bedc
Cr-Commit-Position: refs/heads/master@{#401319}