Fix crash in localSelectionRectOfPositionTemplate() in VisibleUnits.cpp

third_party/WebKit/Source/core/editing/VisibleUnits.cpp

 /*
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights
  * reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 2548 matching lines @@
 LayoutRect localSelectionRectOfPositionTemplate(
     const PositionWithAffinityTemplate<Strategy>& position,
     LayoutObject*& layoutObject) {
   LayoutRect rect = localCaretRectOfPositionTemplate(position, layoutObject);
 
   if (rect.isEmpty())
     return rect;
 
   InlineBoxPosition boxPosition =
       computeInlineBoxPosition(position.position(), position.affinity());
+  // |boxPosition.inlineBox| can be null. See http://crbug.com/680428.
+  if (!boxPosition.inlineBox)
+    return LayoutRect();
 
   InlineTextBox* box = toInlineTextBox(boxPosition.inlineBox);
   if (layoutObject->style()->isHorizontalWritingMode()) {
     rect.setY(box->root().selectionTop());
     rect.setHeight(box->root().selectionHeight());
     return rect;
   }
 
   rect.setX(box->root().selectionTop());
   rect.setWidth(box->root().selectionHeight());
@@ skipping 12 matching lines @@
                                                                layoutObject);
 }
 
 LayoutRect localCaretRectOfPosition(
     const PositionInFlatTreeWithAffinity& position,
     LayoutObject*& layoutObject) {
   return localCaretRectOfPositionTemplate<EditingInFlatTreeStrategy>(
       position, layoutObject);
 }
 
+LayoutRect localSelectionRectOfPosition(

[yosin_UTC9, 2017/01/18 05:37:50]

This function doesn't relate to change of this patch. Please get rid of this.

[joone, 2017/01/18 07:52:17]

This function should have been added to the previous CL so I will separate this
change.

+    const PositionInFlatTreeWithAffinity& position,
+    LayoutObject*& layoutObject) {
+  return localSelectionRectOfPositionTemplate<EditingInFlatTreeStrategy>(
+      position, layoutObject);
+}
+
 static LayoutUnit boundingBoxLogicalHeight(LayoutObject* o,
                                            const LayoutRect& rect) {
   return o->style()->isHorizontalWritingMode() ? rect.height() : rect.width();
 }
 
 bool hasRenderedNonAnonymousDescendantsWithHeight(LayoutObject* layoutObject) {
   LayoutObject* stop = layoutObject->nextInPreOrderAfterChildren();
   for (LayoutObject* o = layoutObject->slowFirstChild(); o && o != stop;
        o = o->nextInPreOrder()) {
     if (o->nonPseudoNode()) {
@@ skipping 670 matching lines @@
 IntRect absoluteSelectionBoundsOf(const VisiblePosition& visiblePosition) {
   return absoluteSelectionBoundsOfAlgorithm<EditingStrategy>(visiblePosition);
 }
 
 IntRect absoluteCaretBoundsOf(
     const VisiblePositionInFlatTree& visiblePosition) {
   return absoluteCaretBoundsOfAlgorithm<EditingInFlatTreeStrategy>(
       visiblePosition);
 }
 
+IntRect absoluteSelectionBoundsOf(

[yosin_UTC9, 2017/01/18 05:37:50]

This function doesn't relate to change of this patch. Please get rid of this.

[joone, 2017/01/18 07:52:17]

Ditto.

+    const VisiblePositionInFlatTree& visiblePosition) {
+  return absoluteSelectionBoundsOfAlgorithm<EditingInFlatTreeStrategy>(
+      visiblePosition);
+}
+
 template <typename Strategy>
 static VisiblePositionTemplate<Strategy> skipToEndOfEditingBoundary(
     const VisiblePositionTemplate<Strategy>& pos,
     const PositionTemplate<Strategy>& anchor) {
   DCHECK(pos.isValid()) << pos;
   if (pos.isNull())
     return pos;
 
   ContainerNode* highestRoot = highestEditableRoot(anchor);
   ContainerNode* highestRootOfPos = highestEditableRoot(pos.deepEquivalent());
@@ skipping 601 matching lines @@
 
 VisiblePositionInFlatTree previousPositionOf(
     const VisiblePositionInFlatTree& visiblePosition,
     EditingBoundaryCrossingRule rule) {
   DCHECK(visiblePosition.isValid()) << visiblePosition;
   return previousPositionOfAlgorithm<EditingInFlatTreeStrategy>(
       visiblePosition.deepEquivalent(), rule);
 }
 
 }  // namespace blink