Range.insertNode should verify parent before setting end to it

Source/core/dom/Range.cpp

Index: Source/core/dom/Range.cpp
diff --git a/Source/core/dom/Range.cpp b/Source/core/dom/Range.cpp
index 0020d59410cc9e7d97e78678df1c14b96fb39b8b..eb1ef036103a84722028992973a2850e404e933e 100644
--- a/Source/core/dom/Range.cpp
+++ b/Source/core/dom/Range.cpp
@@ -894,8 +894,13 @@ void Range::insertNode(PassRefPtrWillBeRawPtr<Node> prpNewNode, ExceptionState&
         if (exceptionState.hadException())
             return;
 
-        if (collapsed)
+        if (collapsed) {
+            if (!newText->parentNode()) {

[Yuta Kitamura, 2014/08/08 06:20:58]

OK, I understand that load event must be fired synchronously.

Could you add some comment about this, since it's tricky to
understand why newText->parentNode() can become null:
* The load event is fired regardless of EventQueueScope; and
* The event handler may mutate the tree so newText->parentNode()
  may become null.

[kangil_, 2014/08/08 06:32:50]

Done.

+                exceptionState.throwDOMException(HierarchyRequestError, "This operation would set range's end to parent with new offset, but there's no parent into which to continue.");
+                return;
+            }
             m_end.setToBeforeChild(*newText);
+        }
     } else {
         RefPtrWillBeRawPtr<Node> lastChild = (newNodeType == Node::DOCUMENT_FRAGMENT_NODE) ? toDocumentFragment(newNode)->lastChild() : newNode.get();
         if (lastChild && lastChild == m_start.childBefore()) {