[InputEvent] Add null check before converting Range to StaticRange

third_party/WebKit/Source/core/editing/EditingUtilities.cpp

 /*
  * Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 2063 matching lines @@
 }
 
 bool isTextSecurityNode(const Node* node) {
   return node && node->layoutObject() &&
          node->layoutObject()->style()->textSecurity() != TSNONE;
 }
 
 const StaticRangeVector* targetRangesForInputEvent(const Node& node) {
   if (!hasRichlyEditableStyle(node))
     return nullptr;
-  return new StaticRangeVector(
-      1, StaticRange::create(
-             firstRangeOf(node.document()
-                              .frame()
-                              ->selection()
-                              .computeVisibleSelectionInDOMTreeDeprecated())));
+  Range* range = createRange(
+      firstEphemeralRangeOf(node.document()
+                                .frame()
+                                ->selection()
+                                .computeVisibleSelectionInDOMTreeDeprecated()));
+  if (!range)
+    return nullptr;
+  return new StaticRangeVector(1, StaticRange::create(range));
 }
 
 DispatchEventResult dispatchBeforeInputInsertText(Node* target,
                                                   const String& data) {
   if (!RuntimeEnabledFeatures::inputEventEnabled())
     return DispatchEventResult::NotCanceled;
   if (!target)
     return DispatchEventResult::NotCanceled;
   // TODO(chongz): Pass appropriate |ranges| after it's defined on spec.
   // http://w3c.github.io/editing/input-events.html#dom-inputevent-inputtype
@@ skipping 69 matching lines @@
         return InputType::DeleteWordBackward;
       if (granularity == LineBoundary)
         return InputType::DeleteLineBackward;
       return InputType::DeleteContentBackward;
     default:
       return InputType::None;
   }
 }
 
 }  // namespace blink