Let Range::expand not crash when Range's start node is not connected to document.

third_party/WebKit/Source/core/dom/RangeTest.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/dom/Range.h"
 
 #include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/V8BindingForTesting.h"
 #include "core/dom/Element.h"
 #include "core/dom/NodeList.h"
 #include "core/dom/Text.h"
 #include "core/editing/EditingTestBase.h"
 #include "core/frame/Settings.h"
 #include "core/html/HTMLBodyElement.h"
+#include "core/html/HTMLDivElement.h"
 #include "core/html/HTMLDocument.h"
 #include "core/html/HTMLElement.h"
 #include "core/html/HTMLHtmlElement.h"
 #include "platform/heap/Handle.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "wtf/Compiler.h"
 #include "wtf/RefPtr.h"
 #include "wtf/text/AtomicString.h"
 
 namespace blink {
@@ skipping 198 matching lines @@
   div->removeChild(span1);
   text->deleteData(0, 3, ASSERT_NO_EXCEPTION);
 
   EXPECT_TRUE(range->boundaryPointsValid());
   EXPECT_EQ(span2, range->startContainer());
   EXPECT_EQ(0u, range->startOffset());
   EXPECT_EQ(div, range->endContainer());
   EXPECT_EQ(2u, range->endOffset());
 }
 
+// Regression test for crbug.com/698123
+TEST_F(RangeTest, ExpandNotCrash) {
+  Range* range = Range::create(document());
+  Node* div = HTMLDivElement::create(document());
+  range->setStart(div, 0, ASSERT_NO_EXCEPTION);
+  range->expand("", ASSERT_NO_EXCEPTION);
+}
+
 }  // namespace blink