[Editing][Stability] Recanonicalize m_originalbase in FrameSelection

third_party/WebKit/Source/core/editing/VisibleUnits.cpp

 /*
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 1909 matching lines @@
 }
 
 template <typename Strategy>
 static InlineBoxPosition computeInlineBoxPositionTemplate(const PositionTemplate<Strategy>& position, TextAffinity affinity, TextDirection primaryDirection)
 {
     InlineBox* inlineBox = nullptr;
     int caretOffset = position.computeEditingOffset();
     Node* const anchorNode = position.anchorNode();
     LayoutObject* layoutObject = anchorNode->isShadowRoot() ? toShadowRoot(anchorNode)->host()->layoutObject() : anchorNode->layoutObject();
 
+    if (!layoutObject)

[yosin_UTC9, 2016/03/15 06:20:40]

We should assume |computeInlineBoxPosition()| called with valid position, e.g.
inDocument() and associated to layout object.

It seems root cause is |FrameSelection| holds obsoleted positions in
|m_originalBase| and |m_originalBaseInFlatTree|, which is passed to
|adjustEndpointsAtBidiBoundar()| then |RenderedPosition| ctor. Since we don't
update |m_originalBase| in |FrameSelection::nodeWillBeRemove()| and
|setOriginalBase()| updates only one of DOM tree or Flat tree original base
position. |setOriginalBase()| should update both DOM ree and Flat tree position.

+        return InlineBoxPosition();
+
     if (!layoutObject->isText()) {
         inlineBox = 0;
         if (canHaveChildrenForEditing(anchorNode) && layoutObject->isLayoutBlockFlow() && hasRenderedNonAnonymousDescendantsWithHeight(layoutObject)) {
             // Try a visually equivalent position with possibly opposite
             // editability. This helps in case |this| is in an editable block
             // but surrounded by non-editable positions. It acts to negate the
             // logic at the beginning of
             // |LayoutObject::createPositionWithAffinity()|.
             PositionTemplate<Strategy> equivalent = downstreamIgnoringEditingBoundaries(position);
             if (equivalent == position) {
@@ skipping 1312 matching lines @@
 {
     return previousPositionOfAlgorithm<EditingStrategy>(visiblePosition, rule);
 }
 
 VisiblePositionInFlatTree previousPositionOf(const VisiblePositionInFlatTree& visiblePosition, EditingBoundaryCrossingRule rule)
 {
     return previousPositionOfAlgorithm<EditingInFlatTreeStrategy>(visiblePosition, rule);
 }
 
 } // namespace blink