Stop flat tree selection canonicalization from using invalid positions

third_party/WebKit/Source/core/editing/FrameSelectionTest.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/editing/FrameSelection.h"
 
 #include <memory>
 #include "bindings/core/v8/ExceptionState.h"
 #include "core/dom/Document.h"
 #include "core/dom/Element.h"
@@ skipping 310 matching lines @@
 
   Selection().SetSelectedRange(
       EphemeralRange(Position(text, 0), Position(text, 12)),
       VP_DEFAULT_AFFINITY, SelectionDirectionalMode::kNonDirectional, 0);
 
   EXPECT_TRUE(Selection().IsHandleVisible())
       << "If handles were present before"
          "selectSetSelectedRange they should be present after it.";
 }
 
+// Regression test for crbug.com/702756
+// Test case excerpted from editing/undo/redo_correct_selection.html
+TEST_F(FrameSelectionTest, SelectInvalidPositionInFlatTreeDoesntCrash) {
+  SetBodyContent("foo<option><select></select></option>");
+  Element* body = GetDocument().body();
+  Element* select = GetDocument().QuerySelector("select");
+  Selection().SetSelection(SelectionInDOMTree::Builder()
+                               .Collapse(Position(body, 0))
+                               // SELECT@AfterAnchor is invalid in flat tree.
+                               .Extend(Position::AfterNode(select))
+                               .Build());
+  // The test passes if it doesn't crash inside.
+  Selection().ComputeVisibleSelectionInFlatTree();

[yosin_UTC9, 2017/04/27 07:02:28]

nit: Let's have EXPECT_EQ() to compare expected VisibleSelectionInFlatTree for
recording current behavior.

[Xiaocheng, 2017/04/27 07:20:46]

The expected selection in flat tree should be '|foo'.

I guess it might be changed in the future?

+}
+
 }  // namespace blink