Fix crash in localSelectionRectOfPositionTemplate() in VisibleUnits.cpp

third_party/WebKit/Source/core/editing/VisibleUnits.cpp

 /*
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights
  * reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 2541 matching lines @@
   return layoutObject->localCaretRect(boxPosition.inlineBox,
                                       boxPosition.offsetInBox);
 }
 
 // This function was added because the caret rect that is calculated by
 // using the line top value instead of the selection top.
 template <typename Strategy>
 LayoutRect localSelectionRectOfPositionTemplate(
     const PositionWithAffinityTemplate<Strategy>& position,
     LayoutObject*& layoutObject) {
-  LayoutRect rect = localCaretRectOfPositionTemplate(position, layoutObject);
+  if (position.isNull()) {
+    layoutObject = nullptr;
+    return LayoutRect();
+  }
+  Node* node = position.anchorNode();
+
+  layoutObject = node->layoutObject();
+  if (!layoutObject)
+    return LayoutRect();
+
+  InlineBoxPosition boxPosition =
+      computeInlineBoxPosition(position.position(), position.affinity());
+
+  if (!boxPosition.inlineBox)
+    return LayoutRect();
+
+  layoutObject = LineLayoutAPIShim::layoutObjectFrom(
+      boxPosition.inlineBox->getLineLayoutItem());
+
+  LayoutRect rect = layoutObject->localCaretRect(boxPosition.inlineBox,
+                                                 boxPosition.offsetInBox);
 
   if (rect.isEmpty())

[joone, 2017/01/20 02:07:29]

If boxPosition.inlineBox isn't InlineTextBox, localCaretRect returns empty rect.

[yosin_UTC9, 2017/01/20 04:28:29]

We need to have a test case of this. I think BR or IMG may be case.
We also attempt to try to find test case. 
Let's try to seek test case rather than reverting patch as time allows. ;-)

     return rect;
 
-  InlineBoxPosition boxPosition =
-      computeInlineBoxPosition(position.position(), position.affinity());
-
   InlineTextBox* box = toInlineTextBox(boxPosition.inlineBox);

[yosin_UTC9, 2017/01/20 04:28:29]

We need to handle if |boxPosition.inlineBox| isn't InlineTextBox.
We also need to have a test case of this.

   if (layoutObject->style()->isHorizontalWritingMode()) {
     rect.setY(box->root().selectionTop());
     rect.setHeight(box->root().selectionHeight());
     return rect;
   }
 
   rect.setX(box->root().selectionTop());
   rect.setWidth(box->root().selectionHeight());
   return rect;
 }
@@ skipping 1321 matching lines @@
 
 VisiblePositionInFlatTree previousPositionOf(
     const VisiblePositionInFlatTree& visiblePosition,
     EditingBoundaryCrossingRule rule) {
   DCHECK(visiblePosition.isValid()) << visiblePosition;
   return previousPositionOfAlgorithm<EditingInFlatTreeStrategy>(
       visiblePosition.deepEquivalent(), rule);
 }
 
 }  // namespace blink