Don't refer to removed spans when reformulating pasted content.

third_party/WebKit/Source/core/editing/commands/ReplaceSelectionCommand.cpp

 /*
  * Copyright (C) 2005, 2006, 2008 Apple Inc. All rights reserved.
  * Copyright (C) 2009, 2010, 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 388 matching lines @@
 
 inline void
 ReplaceSelectionCommand::InsertedNodes::willRemoveNodePreservingChildren(
     Node& node) {
   if (m_firstNodeInserted.get() == node)
     m_firstNodeInserted = NodeTraversal::next(node);
   if (m_lastNodeInserted.get() == node)
     m_lastNodeInserted = node.lastChild()
                              ? node.lastChild()
                              : NodeTraversal::nextSkippingChildren(node);
+  if (m_refNode.get() == node)
+    m_refNode = NodeTraversal::next(node);
 }
 
 inline void ReplaceSelectionCommand::InsertedNodes::willRemoveNode(Node& node) {
   if (m_firstNodeInserted.get() == node && m_lastNodeInserted.get() == node) {
     m_firstNodeInserted = nullptr;
     m_lastNodeInserted = nullptr;
   } else if (m_firstNodeInserted.get() == node) {
     m_firstNodeInserted =
         NodeTraversal::nextSkippingChildren(*m_firstNodeInserted);
   } else if (m_lastNodeInserted.get() == node) {
     m_lastNodeInserted =
         NodeTraversal::previousSkippingChildren(*m_lastNodeInserted);
   }
+  if (node.contains(m_refNode))
+    m_refNode = NodeTraversal::nextSkippingChildren(node);
 }
 
 inline void ReplaceSelectionCommand::InsertedNodes::didReplaceNode(
     Node& node,
     Node& newNode) {
   if (m_firstNodeInserted.get() == node)
     m_firstNodeInserted = &newNode;
   if (m_lastNodeInserted.get() == node)
     m_lastNodeInserted = &newNode;
+  if (m_refNode.get() == node)
+    m_refNode = &newNode;
 }
 
 ReplaceSelectionCommand::ReplaceSelectionCommand(
     Document& document,
     DocumentFragment* fragment,
     CommandOptions options,
     InputEvent::InputType inputType)
     : CompositeEditCommand(document),
       m_selectReplacement(options & SelectReplacement),
       m_smartReplace(options & SmartReplace),
@@ skipping 964 matching lines @@
   //    position being pasted into.
   // 4) Do one of the following:
   //    a) expand the last br if the fragment ends with one and it collapsed,
   //    b) merge the last paragraph of the incoming fragment with the paragraph
   //       that contained the end of the selection that was pasted into, or
   //    c) handle an interchange newline at the end of the incoming fragment.
   // 5) Add spaces for smart replace.
   // 6) Select the replacement if requested, and match style if requested.
 
   InsertedNodes insertedNodes;
-  Node* refNode = fragment.firstChild();
-  DCHECK(refNode);
-  Node* node = refNode->nextSibling();
+  insertedNodes.setRefNode(fragment.firstChild());
+  DCHECK(insertedNodes.refNode());
+  Node* node = insertedNodes.refNode()->nextSibling();
 
-  fragment.removeNode(refNode);
+  fragment.removeNode(insertedNodes.refNode());
 
   Element* blockStart = enclosingBlock(insertionPos.anchorNode());
-  if ((isHTMLListElement(refNode) ||
-       (isLegacyAppleHTMLSpanElement(refNode) &&
-        isHTMLListElement(refNode->firstChild()))) &&
+  if ((isHTMLListElement(insertedNodes.refNode()) ||
+       (isLegacyAppleHTMLSpanElement(insertedNodes.refNode()) &&
+        isHTMLListElement(insertedNodes.refNode()->firstChild()))) &&
       blockStart && blockStart->layoutObject()->isListItem() &&
       hasEditableStyle(*blockStart->parentNode())) {
-    refNode = insertAsListItems(toHTMLElement(refNode), blockStart,
-                                insertionPos, insertedNodes, editingState);
+    insertedNodes.setRefNode(
+        insertAsListItems(toHTMLElement(insertedNodes.refNode()), blockStart,
+                          insertionPos, insertedNodes, editingState));
     if (editingState->isAborted())
       return;
   } else {
-    insertNodeAt(refNode, insertionPos, editingState);
+    insertNodeAt(insertedNodes.refNode(), insertionPos, editingState);
     if (editingState->isAborted())
       return;
-    insertedNodes.respondToNodeInsertion(*refNode);
+    insertedNodes.respondToNodeInsertion(*insertedNodes.refNode());
   }
 
   // Mutation events (bug 22634) may have already removed the inserted content
-  if (!refNode->isConnected())
+  if (!insertedNodes.refNode()->isConnected())
     return;
 
-  bool plainTextFragment = isPlainTextMarkup(refNode);
+  bool plainTextFragment = isPlainTextMarkup(insertedNodes.refNode());
 
   while (node) {
     Node* next = node->nextSibling();
     fragment.removeNode(node);
-    insertNodeAfter(node, refNode, editingState);
+    insertNodeAfter(node, insertedNodes.refNode(), editingState);
     if (editingState->isAborted())
       return;
     insertedNodes.respondToNodeInsertion(*node);
 
     // Mutation events (bug 22634) may have already removed the inserted content
     if (!node->isConnected())
       return;
 
-    refNode = node;
+    insertedNodes.setRefNode(node);
     if (node && plainTextFragment)
       plainTextFragment = isPlainTextMarkup(node);
     node = next;
   }
 
   if (isRichlyEditablePosition(insertionPos))
     removeUnrenderedTextNodesAtEnds(insertedNodes);
 
   if (!handledStyleSpans) {
     handleStyleSpans(insertedNodes, editingState);
@@ skipping 49 matching lines @@
       if (editingState->isAborted())
         return;
     }
   }
 
   makeInsertedContentRoundTrippableWithHTMLTreeBuilder(insertedNodes,
                                                        editingState);
   if (editingState->isAborted())
     return;
 
-  removeRedundantStylesAndKeepStyleSpanInline(insertedNodes, editingState);
-  if (editingState->isAborted())
-    return;
+  {
+    // TODO(dominicc): refNode may not be connected, for example in
+    // LayoutTests/editing/inserting/insert-table-in-paragraph-crash.html .
+    // Refactor this so there's a relationship between the conditions
+    // where refNode is dereferenced and refNode is connected.
+    bool refNodeWasConnected = insertedNodes.refNode()->isConnected();
+    removeRedundantStylesAndKeepStyleSpanInline(insertedNodes, editingState);
+    if (editingState->isAborted())
+      return;
+    DCHECK_EQ(insertedNodes.refNode()->isConnected(), refNodeWasConnected)
+        << insertedNodes.refNode();
+  }
 
   if (m_sanitizeFragment && insertedNodes.firstNodeInserted()) {
     applyCommandToComposite(SimplifyMarkupCommand::create(
                                 document(), insertedNodes.firstNodeInserted(),
                                 insertedNodes.pastLastLeaf()),
                             editingState);
     if (editingState->isAborted())
       return;
   }
 
@@ skipping 23 matching lines @@
 
     // We need to handle the case where we need to merge the end
     // but our destination node is inside an inline that is the last in the
     // block.
     // We insert a placeholder before the newly inserted content to avoid being
     // merged into the inline.
     Node* destinationNode = destination.deepEquivalent().anchorNode();
     if (m_shouldMergeEnd &&
         destinationNode != enclosingInline(destinationNode) &&
         enclosingInline(destinationNode)->nextSibling()) {
-      insertNodeBefore(HTMLBRElement::create(document()), refNode,
-                       editingState);
+      insertNodeBefore(HTMLBRElement::create(document()),
+                       insertedNodes.refNode(), editingState);
       if (editingState->isAborted())
         return;
     }
 
     // Merging the the first paragraph of inserted content with the content that
     // came before the selection that was pasted into would also move content
     // after the selection that was pasted into if: only one paragraph was being
     // pasted, and it was not wrapped in a block, the selection that was pasted
     // into ended at the end of a block and the next paragraph didn't start at
     // the start of a block.
@@ skipping 530 matching lines @@
   visitor->trace(m_startOfInsertedContent);
   visitor->trace(m_endOfInsertedContent);
   visitor->trace(m_insertionStyle);
   visitor->trace(m_documentFragment);
   visitor->trace(m_startOfInsertedRange);
   visitor->trace(m_endOfInsertedRange);
   CompositeEditCommand::trace(visitor);
 }
 
 }  // namespace blink