selection.setBaseAndExtent with null should not crash.

third_party/WebKit/Source/core/editing/DOMSelection.cpp

 /*
  * Copyright (C) 2007, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
@@ skipping 254 matching lines @@
     return;
   }
 
   if (extentOffset < 0) {
     exceptionState.throwDOMException(
         IndexSizeError,
         String::number(extentOffset) + " is not a valid extent offset.");
     return;
   }
 
-  if (!baseNode || !extentNode)
+  if (!baseNode || !extentNode) {
     UseCounter::count(frame(), UseCounter::SelectionSetBaseAndExtentNull);
+    // TODO(editing-dev): Behavior on where base or extent is null is still
+    // under discussion: https://github.com/w3c/selection-api/issues/72
+    if (!baseNode) {

[yosin_UTC9, 2016/12/02 04:38:02]

It seems that dealing nullptr explicitly is more readable.

if (!baseNode) {
  UseCounter::count(frame(), UseCounter::SelectionSetBaseAndExtentNull);
  frame->selection().clear();
  return;
}

if (!extendNode) {
  UseCounter::count(frame(), UseCounter::SelectionSetBaseAndExtentNull);
  collapse(baseNode, baseOffset, exceptionState);
  return;
}

+      frame()->selection().clear();
+      return;
+    }
+    extentOffset = 0;
+  }
 
   if (!isValidForPosition(baseNode) || !isValidForPosition(extentNode))
     return;
 
   // TODO(editing-dev): The use of updateStyleAndLayoutIgnorePendingStylesheets
   // needs to be audited.  See http://crbug.com/590369 for more details.
   // In the long term, we should change FrameSelection::setSelection to take a
   // parameter that does not require clean layout, so that modifying selection
   // no longer performs synchronous layout by itself.
   // TODO(editing-dev): Once SVG USE element doesn't modifies DOM tree, we
@@ skipping 370 matching lines @@
     m_treeScope->document().addConsoleMessage(
         ConsoleMessage::create(JSMessageSource, ErrorMessageLevel, message));
 }
 
 DEFINE_TRACE(DOMSelection) {
   visitor->trace(m_treeScope);
   DOMWindowProperty::trace(visitor);
 }
 
 }  // namespace blink