CANCEL: Make Range::insertNode to validate new end boundary point before using it

Source/core/dom/Range.cpp

Index: Source/core/dom/Range.cpp
diff --git a/Source/core/dom/Range.cpp b/Source/core/dom/Range.cpp
index 645bdf5cbeedac7db4fe83c644799172e78acaa1..626e0b77a9824e4d7422c2019f4c09a0897e4ac7 100644
--- a/Source/core/dom/Range.cpp
+++ b/Source/core/dom/Range.cpp
@@ -895,11 +895,13 @@ void Range::insertNode(PassRefPtrWillBeRawPtr<Node> prpNewNode, ExceptionState&
             return;
 
         container = m_start.container();
+        // When |newNode| is IFRAME, |newText| can be removed from current
+        // document by "load" event handler.
         container->parentNode()->insertBefore(newNode.release(), newText.get(), exceptionState);
         if (exceptionState.hadException())
             return;
 
-        if (collapsed)
+        if (collapsed && newText->parentNode() && newText->ownerDocument() == m_ownerDocument)

[Yuta Kitamura, 2014/07/04 07:11:33]

Is "newText->parentNode()" necessary?

[yosin_UTC9, 2014/07/04 08:45:16]

Yes, the issue is caused by |newText->parentNode() == nullptr|.
Note: |Node::ownerDocument| is never null. Even if node is removed from
document.

owner document check doesn't relate to the issue. I get rid of it from this
patch.
I'll fix in another patch.

             m_end.setToBeforeChild(*newText);
     } else {
         RefPtrWillBeRawPtr<Node> lastChild = (newNodeType == Node::DOCUMENT_FRAGMENT_NODE) ? toDocumentFragment(newNode)->lastChild() : newNode.get();