VisibleSelection::nonBoundaryShadowTreeRootNode should return null when its anchor is a shadow root

Source/core/editing/VisibleSelection.cpp

Index: Source/core/editing/VisibleSelection.cpp
diff --git a/Source/core/editing/VisibleSelection.cpp b/Source/core/editing/VisibleSelection.cpp
index 86c8475baae03cfff83551a44e30657711ac5448..e004d74c8d4d4cae8e5bdf3a468bb1e6fd789fa2 100644
--- a/Source/core/editing/VisibleSelection.cpp
+++ b/Source/core/editing/VisibleSelection.cpp
@@ -752,7 +752,7 @@ Element* VisibleSelection::rootEditableElement() const
 
 Node* VisibleSelection::nonBoundaryShadowTreeRootNode() const
 {
-    return start().deprecatedNode() ? start().deprecatedNode()->nonBoundaryShadowTreeRootNode() : 0;
+    return start().deprecatedNode() && !start().deprecatedNode()->isShadowRoot() ? start().deprecatedNode()->nonBoundaryShadowTreeRootNode() : 0;

[yosin_UTC9, 2015/01/14 01:33:44]

I think |start()| should not point to shadow root. It seems selection adjust
code after node removal made this. So, it is better to change adjust code.

[keishi, 2015/01/14 05:04:51]

I have confirmed that this is what's happening.
1. JS code sets selection to <input type=text>'s UA shadow editor element.
(input1.setSelectionRange(0))
2. input1's type is changed to 'week'.
3. TextFieldInputType::destroyShadowSubtree
4. FrameSelection::nodeWillBeRemoved
5. FrameSelection::respondToNodeModification
6. positionInParentBeforeNode returns the UA shadow root (because it is the
parent of the editor element) which is then set to the VisualSelection::m_start.

How should this work? Where should the selection go when all the elements in the
UA shadow root is removed? Should positionInParentBeforeNode return the shadow
host element instead of the shadow root?

 }
 
 VisibleSelection::ChangeObserver::ChangeObserver()