Merge 159007 "Notify nodes removal to Range/Selection after disp..."

Merge 159007 "Notify nodes removal to Range/Selection after disp..."

> Notify nodes removal to Range/Selection after dispatching blur and mutation event
> 
> This patch changes notifying nodes removal to Range/Selection after dispatching blur and mutation event. In willRemoveChildren(), like willRemoveChild(); r115686 did same change, although it didn't change willRemoveChildren().
> 
> The issue 295010, use-after-free, is caused by setting removed node to Selection in mutation event handler.
> 
> BUG=295010
> TEST=LayoutTests/fast/dom/Range/range-created-during-remove-children.html, LayoutTests/editing/selection/selection-change-in-mutation-event-by-remove-children.html, LayoutTests/editing/selection/selection-change-in-blur-event-by-remove-children.html
> R=tkent@chromium.org
> 
> Review URL: https://codereview.chromium.org/25389004

TBR=yosin@chromium.org

Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=160037

[yosin_UTC9, 2013-10-21 01:34:02]

Committed patchset #1 manually as r160037.