Fixes a crash which occurs when a concealed selection handle in a textfield is exposed.

ui/views/touchui/touch_selection_controller_impl.cc

Index: ui/views/touchui/touch_selection_controller_impl.cc
diff --git a/ui/views/touchui/touch_selection_controller_impl.cc b/ui/views/touchui/touch_selection_controller_impl.cc
index 67a3058418287efd042d2f5ee7f17d8123fe3bed..8508ffc55aa0a1b17a291ff4341c6ddb791daa1a 100644
--- a/ui/views/touchui/touch_selection_controller_impl.cc
+++ b/ui/views/touchui/touch_selection_controller_impl.cc
@@ -125,7 +125,7 @@ gfx::Image* GetHandleImage(ui::SelectionBound::Type bound_type) {
     case ui::SelectionBound::RIGHT:
       return GetRightHandleImage();
     default:
-      NOTREACHED() << "Invalid touch handle bound type.";
+      NOTREACHED() << "Invalid touch handle bound type: " << bound_type;
       return nullptr;
   };
 }
@@ -249,6 +249,10 @@ class TouchSelectionControllerImpl::EditingHandleView
 
   ~EditingHandleView() override { SetWidgetVisible(false, false); }
 
+  ui::SelectionBound::Type selection_bound_type() {
+    return selection_bound_.type();
+  }
+
   // Overridden from views::WidgetDelegateView:
   bool WidgetHasHitTestMask() const override { return true; }
 
@@ -336,7 +340,11 @@ class TouchSelectionControllerImpl::EditingHandleView
       widget_->Hide();
   }
 
-  void SetBoundInScreen(const ui::SelectionBound& bound) {
+  // If |is_visible| is true, this will update the widget and trigger a repaint
+  // if necessary. Otherwise this will only update the internal state:
+  // |selection_bound_| and |image_|, so that the state is valid for the time
+  // this becomes visible.
+  void SetBoundInScreen(const ui::SelectionBound& bound, bool is_visible) {
     bool update_bound_type = false;
     // Cursor handle should always have the bound type CENTER
     DCHECK(!is_cursor_handle_ || bound.type() == ui::SelectionBound::CENTER);
@@ -353,8 +361,13 @@ class TouchSelectionControllerImpl::EditingHandleView
     if (update_bound_type) {
       selection_bound_.set_type(bound.type());
       image_ = GetHandleImage(bound.type());
-      SchedulePaint();
+      if (is_visible)
+        SchedulePaint();
     }
+
+    if (!is_visible)
+      return;
+
     selection_bound_.SetEdge(bound.edge_top(), bound.edge_bottom());
 
     widget_->SetBounds(GetSelectionWidgetBounds(selection_bound_));
@@ -492,7 +505,7 @@ void TouchSelectionControllerImpl::SelectionChanged() {
     // If the new location of this handle is out of client view, its widget
     // should not get hidden, since it should still receive touch events.
     // Hence, we are not using |SetHandleBound()| method here.
-    dragging_handle_->SetBoundInScreen(screen_bound_focus_clipped);
+    dragging_handle_->SetBoundInScreen(screen_bound_focus_clipped, true);
 
     // Temporary fix for selection handle going outside a window. On a webpage,
     // the page should scroll if the selection handle is dragged outside the
@@ -592,8 +605,7 @@ void TouchSelectionControllerImpl::SetHandleBound(
     const ui::SelectionBound& bound,
     const ui::SelectionBound& bound_in_screen) {
   handle->SetWidgetVisible(ShouldShowHandleFor(bound), false);
-  if (handle->IsWidgetVisible())
-    handle->SetBoundInScreen(bound_in_screen);
+  handle->SetBoundInScreen(bound_in_screen, handle->IsWidgetVisible());
 }
 
 bool TouchSelectionControllerImpl::ShouldShowHandleFor(
@@ -739,6 +751,11 @@ gfx::NativeView TouchSelectionControllerImpl::GetCursorHandleNativeView() {
   return cursor_handle_->GetWidget()->GetNativeView();
 }
 
+ui::SelectionBound::Type
+TouchSelectionControllerImpl::GetSelectionHandle1Type() {
+  return selection_handle_1_->selection_bound_type();
+}
+
 gfx::Rect TouchSelectionControllerImpl::GetSelectionHandle1Bounds() {
   return selection_handle_1_->GetBoundsInScreen();
 }