CANCEL: Make Range::insertNode to validate new end boundary point before using it

Source/core/dom/Range.cpp

Index: Source/core/dom/Range.cpp
diff --git a/Source/core/dom/Range.cpp b/Source/core/dom/Range.cpp
index 645bdf5cbeedac7db4fe83c644799172e78acaa1..d211ca03c2abfaa9090bd2ed705809f9442b6bd2 100644
--- a/Source/core/dom/Range.cpp
+++ b/Source/core/dom/Range.cpp
@@ -895,11 +895,13 @@ void Range::insertNode(PassRefPtrWillBeRawPtr<Node> prpNewNode, ExceptionState&
             return;
 
         container = m_start.container();
+        // When |newNode| is IFRAME, |newText| can be removed from current
+        // document by "load" event handler.
         container->parentNode()->insertBefore(newNode.release(), newText.get(), exceptionState);
         if (exceptionState.hadException())
             return;
 
-        if (collapsed)
+        if (collapsed && newText->parentNode())
             m_end.setToBeforeChild(*newText);
     } else {
         RefPtrWillBeRawPtr<Node> lastChild = (newNodeType == Node::DOCUMENT_FRAGMENT_NODE) ? toDocumentFragment(newNode)->lastChild() : newNode.get();