Ensure valid VisiblePosition input for character{Before,After}

third_party/WebKit/Source/core/editing/commands/ReplaceSelectionCommand.cpp

Index: third_party/WebKit/Source/core/editing/commands/ReplaceSelectionCommand.cpp
diff --git a/third_party/WebKit/Source/core/editing/commands/ReplaceSelectionCommand.cpp b/third_party/WebKit/Source/core/editing/commands/ReplaceSelectionCommand.cpp
index f21d21a182bb057c7149e13211f738823bdbaf0f..d28d624f5483989d73df26dd491d15ff3dd4e641 100644
--- a/third_party/WebKit/Source/core/editing/commands/ReplaceSelectionCommand.cpp
+++ b/third_party/WebKit/Source/core/editing/commands/ReplaceSelectionCommand.cpp
@@ -1469,9 +1469,7 @@ static bool isCharacterSmartReplaceExemptConsideringNonBreakingSpace(UChar32 cha
 
 void ReplaceSelectionCommand::addSpacesForSmartReplace(EditingState* editingState)
 {
-    VisiblePosition startOfInsertedContent = positionAtStartOfInsertedContent();
     VisiblePosition endOfInsertedContent = positionAtEndOfInsertedContent();
-
     Position endUpstream = mostBackwardCaretPosition(endOfInsertedContent.deepEquivalent());
     Node* endNode = endUpstream.computeNodeBeforePosition();
     int endOffset = endNode && endNode->isTextNode() ? toText(endNode)->length() : 0;
@@ -1498,6 +1496,7 @@ void ReplaceSelectionCommand::addSpacesForSmartReplace(EditingState* editingStat
 
     document().updateStyleAndLayout();
 
+    VisiblePosition startOfInsertedContent = positionAtStartOfInsertedContent();

[yosin_UTC9, 2016/09/27 08:30:53]

This moving may change behavior due by DOM tree modification between L1473 to
L1496

[Xiaocheng, 2016/09/27 08:48:51]

DCHECK has been added to make sure that |m_startOfInsertedContent| remains the
same, and hence, moving the creation of |startOfInsertedContent| does not change
behvior.

     Position startDownstream = mostForwardCaretPosition(startOfInsertedContent.deepEquivalent());
     Node* startNode = startDownstream.computeNodeAfterPosition();
     unsigned startOffset = 0;