Fix crash when node is moved in a selection

Fix crash when node is moved in a selection

Let RenderObject::canUpdateSelectionOnRootLineBoxes() return false
if the renderer is in an orphaned render tree, to prevent
RenderSelectionInfo from calling selectionRectForPaintInvalidation()
which would cause the crash.

BUG=396596
TEST=editing/selection/move-node-in-selection-crash.html

Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=180102

[Xianzhu, 2014-08-11 16:51:34]

ping...

[eae, 2014-08-11 22:51:48]

Levi would be a better reviewer for this.

[leviw_travelin_and_unemployed, 2014-08-11 23:03:13]

Code change LGTM, but can we make the test a little less cluster-fuzzy?

https://codereview.chromium.org/452293004/diff/40001/LayoutTests/editing/sele...
File LayoutTests/editing/selection/move-node-in-selection-crash.html (right):

https://codereview.chromium.org/452293004/diff/40001/LayoutTests/editing/sele...
LayoutTests/editing/selection/move-node-in-selection-crash.html:2: .c2 + .c9 {
position: fixed; height: 1px; }
Can we remove c2 altogether and just leave the c9 selector?

https://codereview.chromium.org/452293004/diff/40001/LayoutTests/editing/sele...
LayoutTests/editing/selection/move-node-in-selection-crash.html:4: .c16 {
display: -webkit-box; }
How about giving these classes descriptive names?

https://codereview.chromium.org/452293004/diff/40001/LayoutTests/editing/sele...
LayoutTests/editing/selection/move-node-in-selection-crash.html:15: var legend =
document.createElement('legend');
Are these odd types necessary?

[Xianzhu, 2014-08-12 17:32:41]

https://codereview.chromium.org/452293004/diff/40001/LayoutTests/editing/sele...
File LayoutTests/editing/selection/move-node-in-selection-crash.html (right):

https://codereview.chromium.org/452293004/diff/40001/LayoutTests/editing/sele...
LayoutTests/editing/selection/move-node-in-selection-crash.html:2: .c2 + .c9 {
position: fixed; height: 1px; }
On 2014/08/11 23:03:13, leviw wrote:
> Can we remove c2 altogether and just leave the c9 selector?

Done.

https://codereview.chromium.org/452293004/diff/40001/LayoutTests/editing/sele...
LayoutTests/editing/selection/move-node-in-selection-crash.html:4: .c16 {
display: -webkit-box; }
On 2014/08/11 23:03:13, leviw wrote:
> How about giving these classes descriptive names?

Now using tag names in the selectors.

https://codereview.chromium.org/452293004/diff/40001/LayoutTests/editing/sele...
LayoutTests/editing/selection/move-node-in-selection-crash.html:15: var legend =
document.createElement('legend');
On 2014/08/11 23:03:13, leviw wrote:
> Are these odd types necessary?

Tried to remove any of them and the crash couldn't reproduce.
Anyway changed their names to be more descriptive.

[Xianzhu, 2014-08-12 17:32:45]

The CQ bit was checked by wangxianzhu@chromium.org

[commit-bot: I haz the power, 2014-08-12 17:33:18]

CQ is trying da patch. Follow status at
 https://chromium-status.appspot.com/cq/wangxianzhu@chromium.org/452293004/60001

[commit-bot: I haz the power, 2014-08-12 19:18:58]

FYI, CQ is re-trying this CL (attempt #1).
The failing builders are:
  linux_blink_dbg on tryserver.blink
(http://build.chromium.org/p/tryserver.blink/builders/linux_blink_dbg/builds/2...)
  linux_blink_rel on tryserver.blink
(http://build.chromium.org/p/tryserver.blink/builders/linux_blink_rel/builds/2...)
  mac_blink_rel on tryserver.blink
(http://build.chromium.org/p/tryserver.blink/builders/mac_blink_rel/builds/19501)

[Xianzhu, 2014-08-12 19:24:42]

The CQ bit was checked by wangxianzhu@chromium.org

[commit-bot: I haz the power, 2014-08-12 19:25:01]

CQ is trying da patch. Follow status at
 https://chromium-status.appspot.com/cq/wangxianzhu@chromium.org/452293004/80001

[commit-bot: I haz the power, 2014-08-12 21:02:21]

FYI, CQ is re-trying this CL (attempt #1).
The failing builders are:
  win_blink_rel on tryserver.blink
(http://build.chromium.org/p/tryserver.blink/builders/win_blink_rel/builds/22353)

[commit-bot: I haz the power, 2014-08-12 21:40:37]

Change committed as 180102