Fix crash in localSelectionRectOfPositionTemplate() in VisibleUnits.cpp

third_party/WebKit/Source/core/editing/VisibleUnitsTest.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/editing/VisibleUnits.h"
 
 #include "core/dom/Text.h"
 #include "core/editing/EditingTestBase.h"
 #include "core/editing/VisiblePosition.h"
 #include "core/html/TextControlElement.h"
@@ skipping 61 matching lines @@
 
   IntRect boundsInDOMTree =
       absoluteCaretBoundsOf(createVisiblePosition(Position(one, 0)));
   IntRect boundsInFlatTree =
       absoluteCaretBoundsOf(createVisiblePosition(PositionInFlatTree(one, 0)));
 
   EXPECT_FALSE(boundsInDOMTree.isEmpty());
   EXPECT_EQ(boundsInDOMTree, boundsInFlatTree);
 }
 
+TEST_F(VisibleUnitsTest, absoluteSelectionBoundsOf) {
+  const char* bodyContent =
+      "<p id='host'><b id='one'>11</b><b id='two'>22</b></p>";
+  const char* shadowContent =
+      "<div><content select=#two></content><content "
+      "select=#one></content></div>";
+  setBodyContent(bodyContent);
+  setShadowContent(shadowContent, "host");
+
+  Element* body = document().body();
+  Element* one = body->querySelector("#one");
+
+  IntRect boundsInDOMTree =
+      absoluteSelectionBoundsOf(createVisiblePosition(Position(one, 0)));
+  IntRect boundsInFlatTree = absoluteSelectionBoundsOf(
+      createVisiblePosition(PositionInFlatTree(one, 0)));
+
+  EXPECT_FALSE(boundsInDOMTree.isEmpty());
+  EXPECT_EQ(boundsInDOMTree, boundsInFlatTree);
+}
+
 TEST_F(VisibleUnitsTest, associatedLayoutObjectOfFirstLetterPunctuations) {
   const char* bodyContent =
       "<style>p:first-letter {color:red;}</style><p id=sample>(a)bc</p>";
   setBodyContent(bodyContent);
 
   Node* sample = document().getElementById("sample");
   Node* text = sample->firstChild();
 
   LayoutTextFragment* layoutObject0 =
       toLayoutTextFragment(associatedLayoutObjectOf(*text, 0));
@@ skipping 1899 matching lines @@
   // Repro case of crbug.com/584030
   const char* bodyContent =
       "<button><rt><script>document.designMode = 'on'</script></rt></button>";
   setBodyContent(bodyContent);
 
   Node* button = document().querySelector("button");
   EXPECT_TRUE(endsOfNodeAreVisuallyDistinctPositions(button));
 }
 
 }  // namespace blink