Make RenderedRectsForMarkers() to ignore disconnected nodes.

third_party/WebKit/Source/core/editing/markers/DocumentMarkerController.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  *           (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights
  * reserved.
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved.
  * (http://www.torchmobile.com/)
  * Copyright (C) Research In Motion Limited 2010. All rights reserved.
@@ skipping 186 matching lines @@
   return lhv->endOffset() < rhv->startOffset();
 }
 
 static bool doesNotInclude(const Member<RenderedDocumentMarker>& marker,
                            size_t startOffset) {
   return marker->endOffset() < startOffset;
 }
 
 static void updateMarkerRenderedRect(const Node& node,
                                      RenderedDocumentMarker& marker) {
+  DCHECK(node.isConnected()) << node;

[yosin_UTC9, 2017/04/07 04:48:10]

Please move this change into another patch.

[Hwanseung Lee, 2017/04/07 17:55:53]

Done.

   Range* range = Range::create(node.document());
   // The offsets of the marker may be out-dated, so check for exceptions.
   DummyExceptionStateForTesting exceptionState;
   range->setStart(&const_cast<Node&>(node), marker.startOffset(),
                   exceptionState);
   if (!exceptionState.hadException()) {
     range->setEnd(&const_cast<Node&>(node), marker.endOffset(),
                   IGNORE_EXCEPTION_FOR_TESTING);
   }
   if (!exceptionState.hadException()) {
@@ skipping 299 matching lines @@
   if (!possiblyHasMarkers(markerType))
     return result;
   DCHECK(!(m_markers.isEmpty()));
 
   // outer loop: process each node
   MarkerMap::iterator end = m_markers.end();
   for (MarkerMap::iterator nodeIterator = m_markers.begin();
        nodeIterator != end; ++nodeIterator) {
     // inner loop; process each marker in this node
     const Node& node = *nodeIterator->key;
+    if (!node.isConnected())
+      continue;
     MarkerLists* markers = nodeIterator->value.get();
     for (size_t markerListIndex = 0;
          markerListIndex < DocumentMarker::MarkerTypeIndexesCount;
          ++markerListIndex) {
       Member<MarkerList>& list = (*markers)[markerListIndex];
       if (!list || list->isEmpty() || (*list->begin())->type() != markerType)
         continue;
       for (unsigned markerIndex = 0; markerIndex < list->size();
            ++markerIndex) {
         RenderedDocumentMarker* marker = list->at(markerIndex).get();
@@ skipping 347 matching lines @@
 }
 
 }  // namespace blink
 
 #ifndef NDEBUG
 void showDocumentMarkers(const blink::DocumentMarkerController* controller) {
   if (controller)
     controller->showMarkers();
 }
 #endif