Code: bool Editor::insertTextWithoutSendingTextEvent(const String& text,
                                               bool selectInsertedText,
                                               TextEvent* triggeringEvent) {
  if (text.isEmpty())
    return false;

  const VisibleSelection& selection = selectionForCommand(triggeringEvent);
  if (!selection.isContentEditable())
    return false;

  spellChecker().updateMarkersForWordsAffectedByEditing(
      isSpaceOrNewline(text[0]));
 
   TypingCommand::insertText(
      *selection.start().document(), text, selection,
       selectInsertedText ? TypingCommand::SelectInsertedText : 0,
       triggeringEvent && triggeringEvent->isComposition()
           ? TypingCommand::TextCompositionConfirm
          : TypingCommand::TextCompositionNone);

  if (LocalFrame* editedFrame = selection.start().document()->frame()) {
    if (Page* page = editedFrame->page()) {
      LocalFrame* focusedOrMainFrame =
          toLocalFrame(page->focusController().focusedOrMainFrame());
      focusedOrMainFrame->selection().revealSelection(
          ScrollAlignment::alignCenterIfNeeded);
    }
  }

  return true;
}

Vulnerability Type: DoS 
CWE ID: 
Summary: Use-after-free vulnerability in Blink, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging incorrect ordering of operations in the Web SQL Database thread relative to Blink's main thread, related to the shutdown function in web/WebKit.cpp.
Commit Message: Make TypingCommand::insertText() to take SelectionInDOMTree instead of VisibleSelection

This patch makes |TypingCommand::insertText()| to take |SelectionInDOMTree|
instead of |VisibleSelection| to reduce usage of |VisibleSelection| for
improving code health.

BUG=657237
TEST=n/a

Review-Url: https://codereview.chromium.org/2733183002
Cr-Commit-Position: refs/heads/master@{#455368}