Make EphemeralRange constructor not to accept invalid start and end positions

third_party/WebKit/Source/core/editing/spellcheck/TextCheckingHelper.cpp

 /*
  * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 181 matching lines @@
 bool TextCheckingParagraph::isEmpty() const
 {
     // Both predicates should have same result, but we check both just to be sure.
     // We need to investigate to remove this redundancy.
     return isRangeEmpty() || isTextEmpty();
 }
 
 EphemeralRange TextCheckingParagraph::offsetAsRange() const
 {
     DCHECK(m_checkingRange.isNotNull());
-    if (m_offsetAsRange.isNull())
-        m_offsetAsRange = EphemeralRange(paragraphRange().startPosition(), checkingRange().startPosition());
-
+    if (m_offsetAsRange.isNotNull())
+        return m_offsetAsRange;
+    const Position& paragraphStart = paragraphRange().startPosition();
+    const Position& checkingStart = checkingRange().startPosition();
+    if (paragraphStart <= checkingStart) {
+        m_offsetAsRange = EphemeralRange(paragraphStart, checkingStart);
+        return m_offsetAsRange;
+    }
+    // editing/pasteboard/paste-table-001.html and more reach here.
+    m_offsetAsRange = EphemeralRange(checkingStart, paragraphStart);
     return m_offsetAsRange;
 }
 
 const String& TextCheckingParagraph::text() const
 {
     DCHECK(m_checkingRange.isNotNull());
     if (m_text.isEmpty())
         m_text = plainText(paragraphRange());
     return m_text;
 }
@@ skipping 371 matching lines @@
         return false;
 
     const Settings* settings = frame->settings();
     if (!settings)
         return false;
 
     return settings->unifiedTextCheckerEnabled();
 }
 
 } // namespace blink