DOM: Fix a regression of :first-child and :last-child invalidation

third_party/WebKit/Source/core/dom/ContainerNode.h

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2009, 2010, 2011, 2013 Apple Inc. All
  * rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 247 matching lines @@
   };
   enum ChildrenChangeSource {
     ChildrenChangeSourceAPI,
     ChildrenChangeSourceParser
   };
   struct ChildrenChange {
     STACK_ALLOCATED();
 
    public:
     static ChildrenChange forInsertion(Node& node,
+                                       Node* unchangedPrevious,
+                                       Node* unchangedNext,
                                        ChildrenChangeSource byParser) {
       ChildrenChange change = {
           node.isElementNode() ? ElementInserted : NonElementInserted, &node,
-          node.previousSibling(), node.nextSibling(), byParser};
+          unchangedPrevious, unchangedNext, byParser};
       return change;
     }
 
     static ChildrenChange forRemoval(Node& node,
                                      Node* previousSibling,
                                      Node* nextSibling,
                                      ChildrenChangeSource byParser) {
       ChildrenChange change = {
           node.isElementNode() ? ElementRemoved : NonElementRemoved, &node,
           previousSibling, nextSibling, byParser};
       return change;
     }
 
     bool isChildInsertion() const {
       return type == ElementInserted || type == NonElementInserted;
     }
     bool isChildRemoval() const {
       return type == ElementRemoved || type == NonElementRemoved;
     }
     bool isChildElementChange() const {
       return type == ElementInserted || type == ElementRemoved;
     }
 
     ChildrenChangeType type;
     Member<Node> siblingChanged;
+    // |siblingBeforeChange| is
+    //  - siblingChanged.previousSibling before node removal
+    //  - siblingChanged.previousSibling after single node insertion
+    //  - previousSibling of the first inserted node after multiple node
+    //    insertion
     Member<Node> siblingBeforeChange;
+    // |siblingAfterChange| is
+    //  - siblingChanged.nextSibling before node removal
+    //  - siblingChanged.nextSibling after single node insertion
+    //  - nextSibling of the last inserted node after multiple node insertion.
     Member<Node> siblingAfterChange;
     ChildrenChangeSource byParser;
   };
 
   // Notifies the node that it's list of children have changed (either by adding
   // or removing child nodes), or a child node that is of the type
   // CDATA_SECTION_NODE, TEXT_NODE or COMMENT_NODE has changed its value.
   virtual void childrenChanged(const ChildrenChange&);
 
   DECLARE_VIRTUAL_TRACE();
@@ skipping 152 matching lines @@
 
 inline void getChildNodes(ContainerNode& node, NodeVector& nodes) {
   DCHECK(!nodes.size());
   for (Node* child = node.firstChild(); child; child = child->nextSibling())
     nodes.push_back(child);
 }
 
 }  // namespace blink
 
 #endif  // ContainerNode_h