Fix crash in localSelectionRectOfPositionTemplate() in VisibleUnits.cpp

third_party/WebKit/Source/core/editing/VisibleUnits.cpp

Index: third_party/WebKit/Source/core/editing/VisibleUnits.cpp
diff --git a/third_party/WebKit/Source/core/editing/VisibleUnits.cpp b/third_party/WebKit/Source/core/editing/VisibleUnits.cpp
index 7551fa9aca421a97db3626f5ab5ffe45be2a8c94..2278da2eb2736c733a396895403ed8d7c4566be6 100644
--- a/third_party/WebKit/Source/core/editing/VisibleUnits.cpp
+++ b/third_party/WebKit/Source/core/editing/VisibleUnits.cpp
@@ -2559,14 +2559,31 @@ template <typename Strategy>
 LayoutRect localSelectionRectOfPositionTemplate(
     const PositionWithAffinityTemplate<Strategy>& position,
     LayoutObject*& layoutObject) {
-  LayoutRect rect = localCaretRectOfPositionTemplate(position, layoutObject);
+  if (position.isNull()) {
+    layoutObject = nullptr;
+    return LayoutRect();
+  }
+  Node* node = position.anchorNode();
 
-  if (rect.isEmpty())
-    return rect;
+  layoutObject = node->layoutObject();
+  if (!layoutObject)
+    return LayoutRect();
 
   InlineBoxPosition boxPosition =
       computeInlineBoxPosition(position.position(), position.affinity());
 
+  if (!boxPosition.inlineBox)
+    return LayoutRect();
+
+  layoutObject = LineLayoutAPIShim::layoutObjectFrom(
+      boxPosition.inlineBox->getLineLayoutItem());
+
+  LayoutRect rect = layoutObject->localCaretRect(boxPosition.inlineBox,
+                                                 boxPosition.offsetInBox);
+
+  if (rect.isEmpty())

[joone, 2017/01/20 02:07:29]

If boxPosition.inlineBox isn't InlineTextBox, localCaretRect returns empty rect.

[yosin_UTC9, 2017/01/20 04:28:29]

We need to have a test case of this. I think BR or IMG may be case.
We also attempt to try to find test case. 
Let's try to seek test case rather than reverting patch as time allows. ;-)

+    return rect;
+
   InlineTextBox* box = toInlineTextBox(boxPosition.inlineBox);

[yosin_UTC9, 2017/01/20 04:28:29]

We need to handle if |boxPosition.inlineBox| isn't InlineTextBox.
We also need to have a test case of this.

   if (layoutObject->style()->isHorizontalWritingMode()) {
     rect.setY(box->root().selectionTop());