Make redo command not to set invalid selection

third_party/WebKit/Source/core/editing/Editor.cpp

Index: third_party/WebKit/Source/core/editing/Editor.cpp
diff --git a/third_party/WebKit/Source/core/editing/Editor.cpp b/third_party/WebKit/Source/core/editing/Editor.cpp
index 74818e022a20ffb40cba3ae648826a4ca11c544f..07e3fc167a377e360d0d2e73b9571f722364a9ae 100644
--- a/third_party/WebKit/Source/core/editing/Editor.cpp
+++ b/third_party/WebKit/Source/core/editing/Editor.cpp
@@ -810,8 +810,14 @@ void Editor::reappliedEditing(EditCommandComposition* cmd)
     dispatchEditableContentChangedEvents(cmd->startingRootEditableElement(), cmd->endingRootEditableElement());
     dispatchInputEventEditableContentChanged(cmd->startingRootEditableElement(), cmd->endingRootEditableElement(), InputEvent::InputType::Redo, emptyString(), InputEvent::EventIsComposing::NotComposing);
 
+    // TODO(yosin): Since |dispatchEditableContentChangedEvents()| and
+    // |dispatchInputEventEditableContentChanged()|, we would like to know
+    // such case. Once we have a case, this |DCHECK()| should be replaced
+    // with if-statement.
+    DCHECK(frame().document());
     VisibleSelection newSelection(cmd->endingSelection());
-    changeSelectionAfterCommand(newSelection, FrameSelection::CloseTyping | FrameSelection::ClearTypingStyle);
+    if (newSelection.isValidFor(*frame().document()))

[Xiaocheng, 2016/07/04 08:01:37]

The fix looks fine to me, but for curiosity:

It seems that there is no guarantee of having a valid |cmd->endingSelection()|
at this point, for example, the previous event dispatching may just make things
go crazy. So, is it just optional to set selection after redo?

[yosin_UTC9, 2016/07/04 09:57:07]

I may not understand you question fully...

Anything in |cmd| may be invalid, e.g. non-execCommand DOM tree mutation and
event handlers, you mentioned. This reason why we check validity of
|cmd->endSelection()| before calling |changeSelectionAfterCommand()|.

It seems  dispatchEditableContentChangedEvents() and
dispatchInputEventEditableContentChanged() don't validate element parameters, CF
will generate cases for them.

+        changeSelectionAfterCommand(newSelection, FrameSelection::CloseTyping | FrameSelection::ClearTypingStyle);
 
     m_lastEditCommand = nullptr;
     if (UndoStack* undoStack = this->undoStack())