Fix out-of-date offset in selection range code.

Source/core/dom/Range.cpp

Index: Source/core/dom/Range.cpp
diff --git a/Source/core/dom/Range.cpp b/Source/core/dom/Range.cpp
index 6dbb4423e59210e1df4c454a8e19200a668da4f2..37bd906ed437cd8c7d5d8bab759f48453bab4a8e 100644
--- a/Source/core/dom/Range.cpp
+++ b/Source/core/dom/Range.cpp
@@ -1041,14 +1041,15 @@ void Range::insertNode(PassRefPtr<Node> prpNewNode, ExceptionState& es)
         if (collapsed)
             lastChild = (newNodeType == Node::DOCUMENT_FRAGMENT_NODE) ? newNode->lastChild() : newNode;
 
-        int startOffset = m_start.offset();
         container = m_start.container();
-        container->insertBefore(newNode.release(), container->childNode(startOffset), es);
+        container->insertBefore(newNode.release(), container->childNode(m_start.offset()), es);
         if (es.hadException())
             return;
 
+        // Note that m_start.offset() may have changed as a result of container->insertBefore,
+        // when the node we are inserting comes before the range in the same container.
         if (collapsed && numNewChildren)
-            m_end.set(m_start.container(), startOffset + numNewChildren, lastChild.get());
+            m_end.set(m_start.container(), m_start.offset() + numNewChildren, lastChild.get());

[yosin_UTC9, 2013/10/03 01:41:19]

Does |numNewChildren| keep right value when mutation event handler invoked by
container->insertBefore(), removes newNode?

     }
 }