Let Range::expand not crash when Range's start node is not connected to document.

third_party/WebKit/Source/core/dom/RangeTest.cpp

Index: third_party/WebKit/Source/core/dom/RangeTest.cpp
diff --git a/third_party/WebKit/Source/core/dom/RangeTest.cpp b/third_party/WebKit/Source/core/dom/RangeTest.cpp
index 61ac3b4ae8d1a0e501fe145789b873b2cf3c44f5..d321dcf26926c354f22fcca1513d3160b6928ac3 100644
--- a/third_party/WebKit/Source/core/dom/RangeTest.cpp
+++ b/third_party/WebKit/Source/core/dom/RangeTest.cpp
@@ -12,6 +12,7 @@
 #include "core/editing/EditingTestBase.h"
 #include "core/frame/Settings.h"
 #include "core/html/HTMLBodyElement.h"
+#include "core/html/HTMLDivElement.h"
 #include "core/html/HTMLDocument.h"
 #include "core/html/HTMLElement.h"
 #include "core/html/HTMLHtmlElement.h"
@@ -230,4 +231,12 @@ TEST_F(RangeTest, NotMarkedValidByIrrelevantTextRemove) {
   EXPECT_EQ(2u, range->endOffset());
 }
 
+// Regression test for crbug.com/698123
+TEST_F(RangeTest, ExpandNotCrash) {
+  Range* range = Range::create(document());
+  Node* div = HTMLDivElement::create(document());
+  range->setStart(div, 0, ASSERT_NO_EXCEPTION);
+  range->expand("", ASSERT_NO_EXCEPTION);
+}
+
 }  // namespace blink