Check PositionInFlatTree validity in LayoutSelection.

|ToPositionInFlatTree(pos_in_dom)| returned invalid PositionInFlatTree
when |pos_in_dom| is not settled in flat tree.
This patch checks validity of returned PositionInFlatTree.

Bug: 759364
Change-Id: I859e5cfb57a40a9b1f7c1e39a911707a4959f60c
Reviewed-on: https://chromium-review.googlesource.com/656778
Commit-Queue: Yoichi Osato <yoichio@chromium.org>
Reviewed-by: Yoshifumi Inoue <yosin@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#500806}(cherry picked from commit 8a45da3)
Reviewed-on: https://chromium-review.googlesource.com/666364
Reviewed-by: Yoichi Osato <yoichio@chromium.org>
Cr-Commit-Position: refs/branch-heads/3202@{crosswalk-project#215}
Cr-Branched-From: fa6a5d8-refs/heads/master@{#499098}

third_party/WebKit/Source/core/editing/LayoutSelection.cpp

@@ -119,6 +119,16 @@ static SelectionMode ComputeSelectionMode(
   return SelectionMode::kBlockCursor;
 }
 
+// TODO(yoichio): Once we have Position::IsValidFor, use it.
+static bool IsPositionValidFor(const PositionInFlatTree& position,
+                               const Document& document) {
+  DCHECK(position.IsNotNull());
+  if (position.GetDocument() != document)
+    return false;
+
+  return FlatTreeTraversal::Contains(document, *position.AnchorNode());
+}
+
 static EphemeralRangeInFlatTree CalcSelectionInFlatTree(
     const FrameSelection& frame_selection) {
   const SelectionInDOMTree& selection_in_dom =
@@ -131,7 +141,9 @@ static EphemeralRangeInFlatTree CalcSelectionInFlatTree(
           ToPositionInFlatTree(selection_in_dom.Base());
       const PositionInFlatTree& extent =
           ToPositionInFlatTree(selection_in_dom.Extent());
-      if (base.IsNull() || extent.IsNull() || base == extent)
+      if (base.IsNull() || extent.IsNull() || base == extent ||
+          !IsPositionValidFor(base, frame_selection.GetDocument()) ||
+          !IsPositionValidFor(extent, frame_selection.GetDocument()))
         return {};
       return base <= extent ? EphemeralRangeInFlatTree(base, extent)
                             : EphemeralRangeInFlatTree(extent, base);

third_party/WebKit/Source/core/editing/LayoutSelectionTest.cpp

@@ -372,4 +372,25 @@ TEST_F(LayoutSelectionTest, FirstLetterUpdateSeletion) {
   TEST_NO_NEXT_LAYOUT_OBJECT();
 }
 
+TEST_F(LayoutSelectionTest, CommitAppearanceIfNeededNotCrash) {
+  SetBodyContent("<div id='host'><span>bar<span></div><div>baz</div>");
+  SetShadowContent("foo", "host");
+  UpdateAllLifecyclePhases();
+  // <div id='host'>
+  //   #shadow-root
+  //     foo
+  //   <span>|bar</span>
+  // </div>
+  // <div>baz^</div>
+  // |span| is not in flat tree.
+  Node* const span =
+      ToElement(GetDocument().QuerySelector("#host")->firstChild());
+  DCHECK(span);
+  Node* const baz = GetDocument().body()->firstChild()->nextSibling();
+  DCHECK(baz);
+  Selection().SetSelection(SelectionInDOMTree::Builder()
+                               .SetBaseAndExtent({baz, 1}, {span, 0})
+                               .Build());
+  Selection().CommitAppearanceIfNeeded();
+}
 }  // namespace blink