commit a0f5a1c5a050249d3f1be10249a91d88cd18c684
author tkent@chromium.org <tkent@chromium.org@bbb929c8-8fbe-4397-9dbb-9b2b20218538> Thu May 16 06:49:17 2013
committer tkent@chromium.org <tkent@chromium.org@bbb929c8-8fbe-4397-9dbb-9b2b20218538> Thu May 16 06:49:17 2013
tree 8dd1af64e02bcda813cdbda452aa548a77e1ba25
parent cfc31cc67c49485207e480f2f91a72d721f79f7c

Fix an assertion failure in Range::textNodeSplit by Text::splitText.

Range::textNodeSplit is called in Text::splitText, and it assumes the next sibling
node is still a Text node. A DOM mutation event handler can break this assumption.

We had better postpone DOM mutation events dispatched in Node::insertBefore
until exiting splitText to avoid inconsistent Range state.

BUG=240163
TEST=automated.

Review URL: https://chromiumcodereview.appspot.com/14629026

git-svn-id: svn://svn.chromium.org/blink/trunk@150493 bbb929c8-8fbe-4397-9dbb-9b2b20218538