Selection API: Fix a null pointer dereference in addRange().

third_party/WebKit/Source/core/editing/DOMSelection.cpp

 /*
  * Copyright (C) 2007, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
@@ skipping 599 matching lines @@
   // parameter that does not require clean layout, so that modifying selection
   // no longer performs synchronous layout by itself.
   frame()->document()->updateStyleAndLayoutIgnorePendingStylesheets();
 
   if (rangeCount() == 0) {
     selection.setSelectedRange(EphemeralRange(newRange), VP_DEFAULT_AFFINITY);
     cacheRangeIfSelectionOfDocument(newRange);
     return;
   }
 
-  Range* originalRange = selection.firstRange();
+  Range* originalRange = primaryRangeOrNull();
+  DCHECK(originalRange);
 
   if (originalRange->startContainer()->treeScope() !=
       newRange->startContainer()->treeScope()) {
     return;
   }
 
   if (originalRange->compareBoundaryPoints(Range::kStartToEnd, newRange,
                                            ASSERT_NO_EXCEPTION) < 0 ||
       newRange->compareBoundaryPoints(Range::kStartToEnd, originalRange,
                                       ASSERT_NO_EXCEPTION) < 0) {
@@ skipping 182 matching lines @@
     m_treeScope->document().addConsoleMessage(
         ConsoleMessage::create(JSMessageSource, ErrorMessageLevel, message));
 }
 
 DEFINE_TRACE(DOMSelection) {
   visitor->trace(m_treeScope);
   ContextClient::trace(visitor);
 }
 
 }  // namespace blink