Make EphemeralRange constructor not to accept invalid start and end positions

third_party/WebKit/Source/core/editing/spellcheck/SpellChecker.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 661 matching lines @@
         return;
     }
 
     markMisspellings(spellingSelection);
     if (markGrammar)
         markBadGrammar(grammarSelection);
 }
 
 void SpellChecker::updateMarkersForWordsAffectedByEditing(bool doNotRemoveIfSelectionAtWordBoundary)
 {
+    DCHECK(frame().selection().isAvailable());
     TRACE_EVENT0("blink", "SpellChecker::updateMarkersForWordsAffectedByEditing");
     if (!isSpellCheckingEnabledFor(frame().selection().selection()))
         return;
 
     // We want to remove the markers from a word if an editing command will change the word. This can happen in one of
     // several scenarios:
     // 1. Insert in the middle of a word.
     // 2. Appending non whitespace at the beginning of word.
     // 3. Appending non whitespace at the end of word.
     // Note that, appending only whitespaces at the beginning or end of word won't change the word, so we don't need to
@@ skipping 36 matching lines @@
     if (doNotRemoveIfSelectionAtWordBoundary && startOfLastWord.deepEquivalent() == endOfSelection.deepEquivalent()) {
         startOfLastWord = previousWordPosition(startOfLastWord);
         endOfLastWord = endOfWord(startOfLastWord, RightWordIfOnBoundary);
         if (endOfLastWord.deepEquivalent() == startOfSelection.deepEquivalent())
             return;
     }
 
     if (startOfFirstWord.isNull() || endOfFirstWord.isNull() || startOfLastWord.isNull() || endOfLastWord.isNull())
         return;
 
+    const Position& removeMarkerStart = startOfFirstWord.deepEquivalent();
+    const Position& removeMarkerEnd = endOfLastWord.deepEquivalent();
+    if (removeMarkerStart > removeMarkerEnd) {
+        // editing/inserting/insert-br-008.html and more reach here.
+        // TODO(yosin): To avoid |DCHECK(removeMarkerStart <= removeMarkerEnd)|
+        // in |EphemeralRange| constructor, we have this if-statement. Once we
+        // fix |startOfWord()| and |endOfWord()|, we should remove this
+        // if-statement.
+        return;
+    }
+
     // Now we remove markers on everything between startOfFirstWord and endOfLastWord.
     // However, if an autocorrection change a single word to multiple words, we want to remove correction mark from all the
     // resulted words even we only edit one of them. For example, assuming autocorrection changes "avantgarde" to "avant
     // garde", we will have CorrectionIndicator marker on both words and on the whitespace between them. If we then edit garde,
     // we would like to remove the marker from word "avant" and whitespace as well. So we need to get the continous range of
     // of marker that contains the word in question, and remove marker on that whole range.
     Document* document = frame().document();
     DCHECK(document);
-    const EphemeralRange wordRange(startOfFirstWord.deepEquivalent(), endOfLastWord.deepEquivalent());
+    const EphemeralRange wordRange(removeMarkerStart, removeMarkerEnd);
     document->markers().removeMarkers(wordRange, DocumentMarker::MisspellingMarkers(), DocumentMarkerController::RemovePartiallyOverlappingMarker);
 }
 
 void SpellChecker::didEndEditingOnTextField(Element* e)
 {
     TRACE_EVENT0("blink", "SpellChecker::didEndEditingOnTextField");
 
     // Remove markers when deactivating a selection in an <input type="text"/>.
     // Prevent new ones from appearing too.
     m_spellCheckRequester->cancelCheck();
@@ skipping 201 matching lines @@
     visitor->trace(m_frame);
     visitor->trace(m_spellCheckRequester);
 }
 
 void SpellChecker::prepareForLeakDetection()
 {
     m_spellCheckRequester->prepareForLeakDetection();
 }
 
 } // namespace blink