Fix crash in localSelectionRectOfPositionTemplate() in VisibleUnits.cpp

third_party/WebKit/Source/core/editing/VisibleUnitsTest.cpp

Index: third_party/WebKit/Source/core/editing/VisibleUnitsTest.cpp
diff --git a/third_party/WebKit/Source/core/editing/VisibleUnitsTest.cpp b/third_party/WebKit/Source/core/editing/VisibleUnitsTest.cpp
index 3d71e54d8f096db05946560f3c35cb43baca6368..bb894bd882a3ee7f4a9f3669cea1cb8242871f8b 100644
--- a/third_party/WebKit/Source/core/editing/VisibleUnitsTest.cpp
+++ b/third_party/WebKit/Source/core/editing/VisibleUnitsTest.cpp
@@ -79,6 +79,27 @@ TEST_F(VisibleUnitsTest, absoluteCaretBoundsOf) {
   EXPECT_EQ(boundsInDOMTree, boundsInFlatTree);
 }
 
+TEST_F(VisibleUnitsTest, absoluteSelectionBoundsOf) {
+  const char* bodyContent =
+      "<p id='host'><b id='one'>11</b><b id='two'>22</b></p>";
+  const char* shadowContent =
+      "<div><content select=#two></content><content "
+      "select=#one></content></div>";
+  setBodyContent(bodyContent);
+  setShadowContent(shadowContent, "host");
+
+  Element* body = document().body();
+  Element* one = body->querySelector("#one");
+
+  IntRect boundsInDOMTree =
+      absoluteSelectionBoundsOf(createVisiblePosition(Position(one, 0)));
+  IntRect boundsInFlatTree = absoluteSelectionBoundsOf(
+      createVisiblePosition(PositionInFlatTree(one, 0)));
+
+  EXPECT_FALSE(boundsInDOMTree.isEmpty());
+  EXPECT_EQ(boundsInDOMTree, boundsInFlatTree);
+}
+
 TEST_F(VisibleUnitsTest, associatedLayoutObjectOfFirstLetterPunctuations) {
   const char* bodyContent =
       "<style>p:first-letter {color:red;}</style><p id=sample>(a)bc</p>";