Make RenderedRectsForMarkers() to ignore disconnected nodes.

third_party/WebKit/Source/core/editing/markers/DocumentMarkerController.cpp

Index: third_party/WebKit/Source/core/editing/markers/DocumentMarkerController.cpp
diff --git a/third_party/WebKit/Source/core/editing/markers/DocumentMarkerController.cpp b/third_party/WebKit/Source/core/editing/markers/DocumentMarkerController.cpp
index 3f3bcc08e16b712ea1a48c4999cd88cb733fcf71..7252f26d6878c82ceff58358e4d5126aafab8e08 100644
--- a/third_party/WebKit/Source/core/editing/markers/DocumentMarkerController.cpp
+++ b/third_party/WebKit/Source/core/editing/markers/DocumentMarkerController.cpp
@@ -204,6 +204,7 @@ static bool doesNotInclude(const Member<RenderedDocumentMarker>& marker,
 
 static void updateMarkerRenderedRect(const Node& node,
                                      RenderedDocumentMarker& marker) {
+  DCHECK(node.isConnected()) << node;

[yosin_UTC9, 2017/04/07 04:48:10]

Please move this change into another patch.

[Hwanseung Lee, 2017/04/07 17:55:53]

Done.

   Range* range = Range::create(node.document());
   // The offsets of the marker may be out-dated, so check for exceptions.
   DummyExceptionStateForTesting exceptionState;
@@ -523,6 +524,8 @@ Vector<IntRect> DocumentMarkerController::renderedRectsForMarkers(
        nodeIterator != end; ++nodeIterator) {
     // inner loop; process each marker in this node
     const Node& node = *nodeIterator->key;
+    if (!node.isConnected())
+      continue;
     MarkerLists* markers = nodeIterator->value.get();
     for (size_t markerListIndex = 0;
          markerListIndex < DocumentMarker::MarkerTypeIndexesCount;