Make SelectionController not to set invalid selection by mouse down

Source/core/editing/SelectionController.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  * Copyright (C) 2012 Digia Plc. and/or its subsidiary(-ies)
  * Copyright (C) 2015 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
@@ skipping 220 matching lines @@
             if (selectionBaseLayoutObject->isSVGText()) {
                 if (target->layoutObject()->containingBlock() != selectionBaseLayoutObject->containingBlock())
                     return;
             }
         }
     }
 
     if (m_selectionState == SelectionState::HaveNotStartedSelection && !dispatchSelectStart(target))
         return;
 
+    // TODO(yosin) We should check |mousePressNode|, |targetPosition|, and
+    // |newSelection| are valid for |m_frame->document()|.
+    // |dispatchSelectStart()| can change them by "selectstart" event handler.
+
     if (m_selectionState != SelectionState::ExtendedSelection) {
         // Always extend selection here because it's caused by a mouse drag
         m_selectionState = SelectionState::ExtendedSelection;
         newSelection = VisibleSelection(targetPosition);
     }
 
     if (RuntimeEnabledFeatures::userSelectAllEnabled()) {
         Node* rootUserSelectAllForMousePressNode = Position::rootUserSelectAllForNode(mousePressNode);
         if (rootUserSelectAllForMousePressNode && rootUserSelectAllForMousePressNode == Position::rootUserSelectAllForNode(target)) {
             newSelection.setBase(PositionType::beforeNode(rootUserSelectAllForMousePressNode).upstream(CanCrossEditingBoundary));
@@ skipping 27 matching lines @@
 }
 
 bool SelectionController::updateSelectionForMouseDownDispatchingSelectStart(Node* targetNode, const VisibleSelection& selection, TextGranularity granularity)
 {
     if (Position::nodeIsUserSelectNone(targetNode))
         return false;
 
     if (!dispatchSelectStart(targetNode))
         return false;
 
+    if (!selection.isValidFor(*m_frame->document()))
+        return false;
+
     if (selection.isRange()) {
         m_selectionState = SelectionState::ExtendedSelection;
     } else {
         granularity = CharacterGranularity;
         m_selectionState = SelectionState::PlacedCaret;
     }
 
     this->selection().setNonDirectionalSelectionIfNeeded(selection, granularity);
 
     return true;
@@ skipping 344 matching lines @@
     else
         m_selectionState = SelectionState::HaveNotStartedSelection;
 }
 
 FrameSelection& SelectionController::selection() const
 {
     return m_frame->selection();
 }
 
 } // namespace blink