Make EphemeralRange constructor not to accept invalid start and end positions

third_party/WebKit/Source/core/editing/spellcheck/TextCheckingHelper.cpp

Index: third_party/WebKit/Source/core/editing/spellcheck/TextCheckingHelper.cpp
diff --git a/third_party/WebKit/Source/core/editing/spellcheck/TextCheckingHelper.cpp b/third_party/WebKit/Source/core/editing/spellcheck/TextCheckingHelper.cpp
index 19c2e950996a6907d6b75d0e184389b3bfc88e0f..7ba54bf4aacd1a37851e81d99304929ca4abce93 100644
--- a/third_party/WebKit/Source/core/editing/spellcheck/TextCheckingHelper.cpp
+++ b/third_party/WebKit/Source/core/editing/spellcheck/TextCheckingHelper.cpp
@@ -199,9 +199,16 @@ bool TextCheckingParagraph::isEmpty() const
 EphemeralRange TextCheckingParagraph::offsetAsRange() const
 {
     DCHECK(m_checkingRange.isNotNull());
-    if (m_offsetAsRange.isNull())
-        m_offsetAsRange = EphemeralRange(paragraphRange().startPosition(), checkingRange().startPosition());
-
+    if (m_offsetAsRange.isNotNull())
+        return m_offsetAsRange;
+    const Position& paragraphStart = paragraphRange().startPosition();
+    const Position& checkingStart = checkingRange().startPosition();
+    if (paragraphStart <= checkingStart) {
+        m_offsetAsRange = EphemeralRange(paragraphStart, checkingStart);
+        return m_offsetAsRange;
+    }
+    // editing/pasteboard/paste-table-001.html and more reach here.
+    m_offsetAsRange = EphemeralRange(checkingStart, paragraphStart);
     return m_offsetAsRange;
 }