Remove the wrong optimization in replacing a text node with innerHTML

third_party/WebKit/Source/core/editing/serializers/Serialization.cpp

 /*
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights
  * reserved.
  * Copyright (C) 2008, 2009, 2010, 2011 Google Inc. All rights reserved.
  * Copyright (C) 2011 Igalia S.L.
  * Copyright (C) 2011 Motorola Mobility. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
@@ skipping 696 matching lines @@
   ContainerNode* containerNode(container);
 
   ChildListMutationScope mutation(*containerNode);
 
   if (!fragment->firstChild()) {
     containerNode->removeChildren();
     return;
   }
 
   // FIXME: This is wrong if containerNode->firstChild() has more than one ref!
   if (containerNode->hasOneTextChild() && fragment->hasOneTextChild()) {

[tkent, 2016/11/30 03:50:25]

We should remove this block.  This is a wrong optimization.

e.g.

<div>original</div>

var originalText = div.firstChild;
div.innerHTML = 'updated';
console.log(originalText.data);
// It should show "original", but shows "udpated".

This is a regression by Oilpan, I think.

[hayato, 2016/11/30 05:22:55]

Agreed. I removed this optimization.

+    containerNode->firstChild()->checkSlotChangeBeforeRemoved();
     toText(containerNode->firstChild())
         ->setData(toText(fragment->firstChild())->data());
+    containerNode->firstChild()->checkSlotChangeAfterInserted();
     return;
   }
 
   // FIXME: No need to replace the child it is a text node and its contents are
   // already == text.
   if (containerNode->hasOneChild()) {
     containerNode->replaceChild(fragment, containerNode->firstChild(),
                                 exceptionState);
     return;
   }
@@ skipping 52 matching lines @@
   textNode->appendData(textNext->data());
   if (textNext->parentNode())  // Might have been removed by mutation event.
     textNext->remove(exceptionState);
 }
 
 template class CORE_TEMPLATE_EXPORT CreateMarkupAlgorithm<EditingStrategy>;
 template class CORE_TEMPLATE_EXPORT
     CreateMarkupAlgorithm<EditingInFlatTreeStrategy>;
 
 }  // namespace blink