Add null position check in SpellChecker::findFirstMisspelling

third_party/WebKit/Source/core/editing/spellcheck/SpellCheckerTest.cpp

Index: third_party/WebKit/Source/core/editing/spellcheck/SpellCheckerTest.cpp
diff --git a/third_party/WebKit/Source/core/editing/spellcheck/SpellCheckerTest.cpp b/third_party/WebKit/Source/core/editing/spellcheck/SpellCheckerTest.cpp
index f04995976e7af895203b121b5eb8d4b20c9c036e..1d2d4c5315bf42c3d9e0d02275ce1bb7acdc65b7 100644
--- a/third_party/WebKit/Source/core/editing/spellcheck/SpellCheckerTest.cpp
+++ b/third_party/WebKit/Source/core/editing/spellcheck/SpellCheckerTest.cpp
@@ -40,6 +40,23 @@ TEST_F(SpellCheckerTest, AdvanceToNextMisspellingWithEmptyInputNoCrash) {
       document().frame()->editor().executeCommand("AdvanceToNextMisspelling"));
 }
 
+// Regression test for crbug.com/701309
+TEST_F(SpellCheckerTest, AdvanceToNextMisspellingWithImageInTableNoCrash) {
+  setBodyContent(
+      "<div contenteditable>"
+      "<table><tr><td>"
+      "<img src=foo.jpg>"
+      "</td></tr></table>"
+      "zz zz zz"
+      "</div>");
+  document().querySelector("div")->focus();
+  updateAllLifecyclePhases();
+
+  // Do not crash in AdvanceToNextMisspelling command.
+  EXPECT_TRUE(
+      document().frame()->editor().executeCommand("AdvanceToNextMisspelling"));

[yosin_UTC9, 2017/03/15 03:50:48]

It is better to call |SpellChecker::advanceToNextMisspelling(false)| directly to
reduce dependency of this test.

BTW, We don't need to make |startBeforeSelection| of
|advanceToNextMisspelling()| as default parameters, since
all call sites, two places, passed a parameter.

I think it is better two split into three functions, one for executeCommand,
second is for showSpellingGuessPanel,
and third is advanceToNextMisspelling() take |Position|.

[Xiaocheng, 2017/03/15 18:12:26]

Done.
Will do.
I don't quite understand this part... Could you explain?

+}
+
 TEST_F(SpellCheckerTest, SpellCheckDoesNotCauseUpdateLayout) {
   setBodyContent("<input>");
   HTMLInputElement* input =