[Editing][Stability] Recanonicalize m_originalbase in FrameSelection

third_party/WebKit/Source/core/editing/VisibleUnits.cpp

Index: third_party/WebKit/Source/core/editing/VisibleUnits.cpp
diff --git a/third_party/WebKit/Source/core/editing/VisibleUnits.cpp b/third_party/WebKit/Source/core/editing/VisibleUnits.cpp
index 150706e606f6151d00ddd38568493bacf6631963..9528edccdbb17e398ad43cb40cbb2abe5b3bbc0d 100644
--- a/third_party/WebKit/Source/core/editing/VisibleUnits.cpp
+++ b/third_party/WebKit/Source/core/editing/VisibleUnits.cpp
@@ -1927,6 +1927,9 @@ static InlineBoxPosition computeInlineBoxPositionTemplate(const PositionTemplate
     Node* const anchorNode = position.anchorNode();
     LayoutObject* layoutObject = anchorNode->isShadowRoot() ? toShadowRoot(anchorNode)->host()->layoutObject() : anchorNode->layoutObject();
 
+    if (!layoutObject)

[yosin_UTC9, 2016/03/15 06:20:40]

We should assume |computeInlineBoxPosition()| called with valid position, e.g.
inDocument() and associated to layout object.

It seems root cause is |FrameSelection| holds obsoleted positions in
|m_originalBase| and |m_originalBaseInFlatTree|, which is passed to
|adjustEndpointsAtBidiBoundar()| then |RenderedPosition| ctor. Since we don't
update |m_originalBase| in |FrameSelection::nodeWillBeRemove()| and
|setOriginalBase()| updates only one of DOM tree or Flat tree original base
position. |setOriginalBase()| should update both DOM ree and Flat tree position.

+        return InlineBoxPosition();
+
     if (!layoutObject->isText()) {
         inlineBox = 0;
         if (canHaveChildrenForEditing(anchorNode) && layoutObject->isLayoutBlockFlow() && hasRenderedNonAnonymousDescendantsWithHeight(layoutObject)) {