Crash in CompositeEditCommand::InsertNodeBefore

InsertNodeBefore crashes if the passed ref_child
is disconnected.

Bug: 755808
Change-Id: I4c07836b6d0f055f2cdfd8f94c326fcaaf03d6ca
Reviewed-on: https://chromium-review.googlesource.com/893243Reviewed-by: Yoshifumi Inoue <yosin@chromium.org>
Reviewed-by: Xiaocheng Hu <xiaochengh@chromium.org>
Commit-Queue: Tanvir Rizvi <tanvir.rizvi@samsung.com>
Cr-Commit-Position: refs/heads/master@{#533222}

third_party/WebKit/Source/core/editing/commands/CompositeEditCommand.cpp

@@ -288,6 +288,7 @@ void CompositeEditCommand::InsertNodeBefore(
     ShouldAssumeContentIsAlwaysEditable
         should_assume_content_is_always_editable) {
   DCHECK_NE(GetDocument().body(), ref_child);
+  ABORT_EDITING_COMMAND_IF(!ref_child->parentNode());
   // TODO(editing-dev): Use of updateStyleAndLayoutIgnorePendingStylesheets
   // needs to be audited.  See http://crbug.com/590369 for more details.
   GetDocument().UpdateStyleAndLayoutIgnorePendingStylesheets();

third_party/WebKit/Source/core/editing/commands/CompositeEditCommandTest.cpp

@@ -134,4 +134,16 @@ TEST_F(CompositeEditCommandTest,
       body->InnerHTMLAsString());
 }
 
+TEST_F(CompositeEditCommandTest, InsertNodeOnDisconnectedParent) {
+  SetBodyContent("<p><b></b></p>");
+  SampleCommand& sample = *new SampleCommand(GetDocument());
+  Node* insert_child = GetDocument().QuerySelector("b");
+  Element* ref_child = GetDocument().QuerySelector("p");
+  ref_child->remove();
+  EditingState editing_state;
+  // editing state should abort here.
+  sample.InsertNodeBefore(insert_child, ref_child, &editing_state);
+  EXPECT_TRUE(editing_state.IsAborted());
+}
+
 }  // namespace blink