Fix selectionEnd value in a case of dragging out from an INPUT element.

third_party/WebKit/Source/core/html/HTMLTextFormControlElement.h

Index: third_party/WebKit/Source/core/html/HTMLTextFormControlElement.h
diff --git a/third_party/WebKit/Source/core/html/HTMLTextFormControlElement.h b/third_party/WebKit/Source/core/html/HTMLTextFormControlElement.h
index dd8b3ae14b142a4cee8c21ad3335dfca42bdb8a9..7e1c33f99bb9aafe310547ae232ac3090cd8795d 100644
--- a/third_party/WebKit/Source/core/html/HTMLTextFormControlElement.h
+++ b/third_party/WebKit/Source/core/html/HTMLTextFormControlElement.h
@@ -25,6 +25,7 @@
 #ifndef HTMLTextFormControlElement_h
 #define HTMLTextFormControlElement_h
 
+#include "base/gtest_prod_util.h"
 #include "core/CoreExport.h"
 #include "core/editing/VisiblePosition.h"
 #include "core/html/HTMLFormControlElementWithState.h"
@@ -134,12 +135,12 @@ private:
     void cacheSelection(int start, int end, TextFieldSelectionDirection direction)
     {
         DCHECK_GE(start, 0);
-        // TODO(tkent): Add DCHECK_LE(start, end). It breaks
-        // editing/selection/select-across-readonly-input-{1,4}.html
+        DCHECK_LE(start, end);
         m_cachedSelectionStart = start;
         m_cachedSelectionEnd = end;
         m_cachedSelectionDirection = direction;
     }
+    static int indexForPosition(HTMLElement* innerEditor, const Position&);
 
     void dispatchFocusEvent(Element* oldFocusedElement, WebFocusType, InputDeviceCapabilities* sourceCapabilities) final;
     void dispatchBlurEvent(Element* newFocusedElement, WebFocusType, InputDeviceCapabilities* sourceCapabilities) final;
@@ -162,6 +163,8 @@ private:
     int m_cachedSelectionStart;
     int m_cachedSelectionEnd;
     TextFieldSelectionDirection m_cachedSelectionDirection;
+
+    FRIEND_TEST_ALL_PREFIXES(HTMLTextFormControlElementTest, IndexForPosition);
 };
 
 inline bool isHTMLTextFormControlElement(const Element& element)