Don't use dangling reference in ReplaceSelectionCommand::removeRedundantStylesAndKeepStyleSpanInline

Don't use dangling reference in ReplaceSelectionCommand::removeRedundantStylesAndKeepStyleSpanInline

This patch changes to avoid dangling reference in ReplaceSelectionCommand::removeRedundantStylesAndKeepStyleSpanInline().
In this function, we hold pointer to inlineStyle member in ElemendData from
|node|. The |node| doesn't change in loop body unless it doesn't have a
self-conflicting inline style, e.g. <b style="font-weight: normal">. In this
case, we should update |inlineStyle| variable to new value from ElementData of
newly created element.

Note: Attached test case is failed only on ASAN build by heap-use-after-free.

BUG=356517
TEST=LayoutTests/editing/execCommand/remove-redundant-styles-and-keep-style-span-inline-crashed.html

Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=170133

[Yuta Kitamura, 2014-03-27 01:50:15]

Is this ready for review?

[yosin_UTC9, 2014-03-27 01:50:27]

Could you review this patch?
Thanks in advance.

[yosin_UTC9, 2014-03-27 01:51:30]

Note: linux-asan-bot failures aren't related to this patch.

[Yuta Kitamura, 2014-03-27 02:03:22]

Just lots of wordsmithing; LGTM.

Please wrap the change description for each 80-ish characters.

In change description:
"Make not to use" -> "Don't use"
"to avoid using dangling reference" -> remove
"The |node| isn't change" -> "The |node| doesn't change"
"except for" -> "unless"?
"conflict inline style" -> "a self-conflicting inline style"
"Attach test case" -> "Attached test case"

https://codereview.chromium.org/212323004/diff/1/LayoutTests/editing/execComm...
File
LayoutTests/editing/execCommand/remove-redundant-styles-and-keep-style-span-inline-crashed.html
(right):

https://codereview.chromium.org/212323004/diff/1/LayoutTests/editing/execComm...
LayoutTests/editing/execCommand/remove-redundant-styles-and-keep-style-span-inline-crashed.html:12:
<i>PASS if Blink isn't crashed.</i>
nit: isn't crashed -> doesn't crash

[yosin_UTC9, 2014-03-27 03:30:09]

Thanks!
committing...

https://codereview.chromium.org/212323004/diff/1/LayoutTests/editing/execComm...
File
LayoutTests/editing/execCommand/remove-redundant-styles-and-keep-style-span-inline-crashed.html
(right):

https://codereview.chromium.org/212323004/diff/1/LayoutTests/editing/execComm...
LayoutTests/editing/execCommand/remove-redundant-styles-and-keep-style-span-inline-crashed.html:12:
<i>PASS if Blink isn't crashed.</i>
On 2014/03/27 02:03:23, Yuta Kitamura wrote:
> nit: isn't crashed -> doesn't crash

Done.

[yosin_UTC9, 2014-03-27 03:30:13]

The CQ bit was checked by yosin@chromium.org

[commit-bot: I haz the power, 2014-03-27 03:30:20]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/yosin@chromium.org/212323004/60001

[commit-bot: I haz the power, 2014-03-27 04:33:34]

Change committed as 170133