Add null position check in SpellChecker::findFirstMisspelling

third_party/WebKit/Source/core/editing/spellcheck/SpellCheckerTest.cpp

Index: third_party/WebKit/Source/core/editing/spellcheck/SpellCheckerTest.cpp
diff --git a/third_party/WebKit/Source/core/editing/spellcheck/SpellCheckerTest.cpp b/third_party/WebKit/Source/core/editing/spellcheck/SpellCheckerTest.cpp
index f04995976e7af895203b121b5eb8d4b20c9c036e..1b6fbca103e33089c6677e7eeecb86c8c956ebde 100644
--- a/third_party/WebKit/Source/core/editing/spellcheck/SpellCheckerTest.cpp
+++ b/third_party/WebKit/Source/core/editing/spellcheck/SpellCheckerTest.cpp
@@ -40,6 +40,22 @@ TEST_F(SpellCheckerTest, AdvanceToNextMisspellingWithEmptyInputNoCrash) {
       document().frame()->editor().executeCommand("AdvanceToNextMisspelling"));
 }
 
+// Regression test for crbug.com/701309
+TEST_F(SpellCheckerTest, AdvanceToNextMisspellingWithImageInTableNoCrash) {
+  setBodyContent(
+      "<div contenteditable>"
+      "<table><tr><td>"
+      "<img src=foo.jpg>"
+      "</td></tr></table>"
+      "zz zz zz"
+      "</div>");
+  document().querySelector("div")->focus();
+  updateAllLifecyclePhases();
+
+  // Do not crash in advanceToNextMisspelling.
+  document().frame()->spellChecker().advanceToNextMisspelling(false);
+}
+
 TEST_F(SpellCheckerTest, SpellCheckDoesNotCauseUpdateLayout) {
   setBodyContent("<input>");
   HTMLInputElement* input =