Make RenderedRectsForMarkers() to ignore disconnected nodes.

third_party/WebKit/Source/core/editing/markers/DocumentMarkerController.cpp

Index: third_party/WebKit/Source/core/editing/markers/DocumentMarkerController.cpp
diff --git a/third_party/WebKit/Source/core/editing/markers/DocumentMarkerController.cpp b/third_party/WebKit/Source/core/editing/markers/DocumentMarkerController.cpp
index 34506d1809171ca1ef41fdc04d995e252f4aa773..7e0b3c00f59540fe14a141445c06d7e47b5a35f3 100644
--- a/third_party/WebKit/Source/core/editing/markers/DocumentMarkerController.cpp
+++ b/third_party/WebKit/Source/core/editing/markers/DocumentMarkerController.cpp
@@ -204,6 +204,7 @@ static bool doesNotInclude(const Member<RenderedDocumentMarker>& marker,
 
 static void updateMarkerRenderedRect(const Node& node,
                                      RenderedDocumentMarker& marker) {
+  DCHECK(node.isConnected()) << node;
   Range* range = Range::create(node.document());
   // The offsets of the marker may be out-dated, so check for exceptions.
   DummyExceptionStateForTesting exceptionState;
@@ -523,6 +524,8 @@ Vector<IntRect> DocumentMarkerController::renderedRectsForMarkers(
        nodeIterator != end; ++nodeIterator) {
     // inner loop; process each marker in this node
     const Node& node = *nodeIterator->key;
+    if (!node.isConnected())
+      continue;
     MarkerLists* markers = nodeIterator->value.get();
     for (size_t markerListIndex = 0;
          markerListIndex < DocumentMarker::MarkerTypeIndexesCount;