Notify nodes removal to Range/Selection after dispatching blur and mutation event

Source/core/dom/ContainerNode.cpp

Index: Source/core/dom/ContainerNode.cpp
diff --git a/Source/core/dom/ContainerNode.cpp b/Source/core/dom/ContainerNode.cpp
index 7de1712a03c22b9aa36bec7ac9df8f964ddb5bb9..515209937bb2f9981bfa8932f567db36d0eef1a2 100644
--- a/Source/core/dom/ContainerNode.cpp
+++ b/Source/core/dom/ContainerNode.cpp
@@ -401,8 +401,6 @@ static void willRemoveChildren(ContainerNode* container)
     NodeVector children;
     getChildNodes(container, children);
 
-    container->document().nodeChildrenWillBeRemoved(container);
-
     ChildListMutationScope mutation(container);
     for (NodeVector::const_iterator it = children.begin(); it != children.end(); it++) {
         Node* child = it->get();
@@ -413,6 +411,7 @@ static void willRemoveChildren(ContainerNode* container)
         dispatchChildRemovalEvents(child);
     }
 
+    container->document().nodeChildrenWillBeRemoved(container); // e.g. mutation event listener can create a new range.

[tkent, 2013/10/04 05:21:39]

After this line, It is possible to dispatch 'blur' event or
'DOMSubtreeModfified' event.

[yosin_UTC9, 2013/10/04 08:09:30]

It is safe in 'DOMSubtreeModfified' event handler, because node is already
removed in tree. Setting removed node throws an exception.

For 'blur', you're right. I changed order in ContainerNode::removeChildren() as
Container::removeChild().

[tkent, 2013/10/06 23:46:54]

The comment in removeChildren says:

         // This must be later than willRemoveChildren, which might change focus
         // state of a child.
         document().removeFocusedElementOfSubtree(this, true);

It seems removeChild() is wrong.

Can we move only nodeChildrenWillBeRemoved() call after
Document::removeFocusedElementOfSubtree()?

     ChildFrameDisconnector(container).disconnect(ChildFrameDisconnector::DescendantsOnly);
 }