Add null position check in SpellChecker::findFirstMisspelling

third_party/WebKit/Source/core/editing/spellcheck/SpellCheckerTest.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/editing/spellcheck/SpellChecker.h"
 
 #include "core/editing/Editor.h"
 #include "core/editing/spellcheck/SpellCheckTestBase.h"
 #include "core/frame/FrameView.h"
 #include "core/frame/LocalFrame.h"
@@ skipping 22 matching lines @@
 TEST_F(SpellCheckerTest, AdvanceToNextMisspellingWithEmptyInputNoCrash) {
   setBodyContent("<input placeholder='placeholder'>abc");
   updateAllLifecyclePhases();
   Element* input = document().querySelector("input");
   input->focus();
   // Do not crash in AdvanceToNextMisspelling command.
   EXPECT_TRUE(
       document().frame()->editor().executeCommand("AdvanceToNextMisspelling"));
 }
 
+// Regression test for crbug.com/701309
+TEST_F(SpellCheckerTest, AdvanceToNextMisspellingWithImageInTableNoCrash) {
+  setBodyContent(
+      "<div contenteditable>"
+      "<table><tr><td>"
+      "<img src=foo.jpg>"
+      "</td></tr></table>"
+      "zz zz zz"
+      "</div>");
+  document().querySelector("div")->focus();
+  updateAllLifecyclePhases();
+
+  // Do not crash in AdvanceToNextMisspelling command.
+  EXPECT_TRUE(
+      document().frame()->editor().executeCommand("AdvanceToNextMisspelling"));

[yosin_UTC9, 2017/03/15 03:50:48]

It is better to call |SpellChecker::advanceToNextMisspelling(false)| directly to
reduce dependency of this test.

BTW, We don't need to make |startBeforeSelection| of
|advanceToNextMisspelling()| as default parameters, since
all call sites, two places, passed a parameter.

I think it is better two split into three functions, one for executeCommand,
second is for showSpellingGuessPanel,
and third is advanceToNextMisspelling() take |Position|.

[Xiaocheng, 2017/03/15 18:12:26]

Done.
Will do.
I don't quite understand this part... Could you explain?

+}
+
 TEST_F(SpellCheckerTest, SpellCheckDoesNotCauseUpdateLayout) {
   setBodyContent("<input>");
   HTMLInputElement* input =
       toHTMLInputElement(document().querySelector("input"));
   input->focus();
   input->setValue("Hello, input field");
   document().updateStyleAndLayout();
   VisibleSelection oldSelection =
       document()
           .frame()
           ->selection()
           .computeVisibleSelectionInDOMTreeDeprecated();
 
   Position newPosition(input->innerEditorElement()->firstChild(), 3);
   document().frame()->selection().setSelection(
       SelectionInDOMTree::Builder().collapse(newPosition).build());
   ASSERT_EQ(3u, input->selectionStart());
 
   EXPECT_TRUE(frame().spellChecker().isSpellCheckingEnabled());
   forceLayout();
   int startCount = layoutCount();
   frame().spellChecker().respondToChangedSelection(
       oldSelection.start(),
       FrameSelection::CloseTyping | FrameSelection::ClearTypingStyle);
   EXPECT_EQ(startCount, layoutCount());
 }
 
 }  // namespace blink