Notify nodes removal to Range/Selection after dispatching blur and mutation event

Source/core/dom/ContainerNode.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 383 matching lines @@
     dispatchChildRemovalEvents(child);
     child->document().nodeWillBeRemoved(child); // e.g. mutation event listener can create a new range.
     ChildFrameDisconnector(child).disconnect();
 }
 
 static void willRemoveChildren(ContainerNode* container)
 {
     NodeVector children;
     getChildNodes(container, children);
 
-    container->document().nodeChildrenWillBeRemoved(container);
-
     ChildListMutationScope mutation(container);
     for (NodeVector::const_iterator it = children.begin(); it != children.end(); it++) {
         Node* child = it->get();
         mutation.willRemoveChild(child);
         child->notifyMutationObserversNodeWillDetach();
 
         // fire removed from document mutation events.
         dispatchChildRemovalEvents(child);
     }
 
+    container->document().nodeChildrenWillBeRemoved(container); // e.g. mutation event listener can create a new range.

[tkent, 2013/10/04 05:21:39]

After this line, It is possible to dispatch 'blur' event or
'DOMSubtreeModfified' event.

[yosin_UTC9, 2013/10/04 08:09:30]

It is safe in 'DOMSubtreeModfified' event handler, because node is already
removed in tree. Setting removed node throws an exception.

For 'blur', you're right. I changed order in ContainerNode::removeChildren() as
Container::removeChild().

[tkent, 2013/10/06 23:46:54]

The comment in removeChildren says:

         // This must be later than willRemoveChildren, which might change focus
         // state of a child.
         document().removeFocusedElementOfSubtree(this, true);

It seems removeChild() is wrong.

Can we move only nodeChildrenWillBeRemoved() call after
Document::removeFocusedElementOfSubtree()?

     ChildFrameDisconnector(container).disconnect(ChildFrameDisconnector::DescendantsOnly);
 }
 
 void ContainerNode::disconnectDescendantFrames()
 {
     ChildFrameDisconnector(this).disconnect();
 }
 
 void ContainerNode::removeChild(Node* oldChild, ExceptionState& es)
 {
@@ skipping 553 matching lines @@
         return true;
 
     if (node->isElementNode() && toElement(node)->shadow())
         return true;
 
     return false;
 }
 #endif
 
 } // namespace WebCore