Remove the wrong optimization in replacing a text node with innerHTML

third_party/WebKit/Source/core/editing/serializers/Serialization.cpp

Index: third_party/WebKit/Source/core/editing/serializers/Serialization.cpp
diff --git a/third_party/WebKit/Source/core/editing/serializers/Serialization.cpp b/third_party/WebKit/Source/core/editing/serializers/Serialization.cpp
index bf02c4e921063660c3dab572aa2b4d9dca6b0ea8..37da977f033f8a7dff85d956058a6ec9d5a70990 100644
--- a/third_party/WebKit/Source/core/editing/serializers/Serialization.cpp
+++ b/third_party/WebKit/Source/core/editing/serializers/Serialization.cpp
@@ -715,8 +715,10 @@ void replaceChildrenWithFragment(ContainerNode* container,
 
   // FIXME: This is wrong if containerNode->firstChild() has more than one ref!
   if (containerNode->hasOneTextChild() && fragment->hasOneTextChild()) {

[tkent, 2016/11/30 03:50:25]

We should remove this block.  This is a wrong optimization.

e.g.

<div>original</div>

var originalText = div.firstChild;
div.innerHTML = 'updated';
console.log(originalText.data);
// It should show "original", but shows "udpated".

This is a regression by Oilpan, I think.

[hayato, 2016/11/30 05:22:55]

Agreed. I removed this optimization.

+    containerNode->firstChild()->checkSlotChangeBeforeRemoved();
     toText(containerNode->firstChild())
         ->setData(toText(fragment->firstChild())->data());
+    containerNode->firstChild()->checkSlotChangeAfterInserted();
     return;
   }