Stop flat tree selection canonicalization from using invalid positions

third_party/WebKit/Source/core/editing/FrameSelectionTest.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/editing/FrameSelection.h"
 
 #include <memory>
 #include "bindings/core/v8/ExceptionState.h"
 #include "core/dom/Document.h"
 #include "core/dom/Element.h"
@@ skipping 310 matching lines @@
 
   Selection().SetSelectedRange(
       EphemeralRange(Position(text, 0), Position(text, 12)),
       VP_DEFAULT_AFFINITY, SelectionDirectionalMode::kNonDirectional, 0);
 
   EXPECT_TRUE(Selection().IsHandleVisible())
       << "If handles were present before"
          "selectSetSelectedRange they should be present after it.";
 }
 
+// Regression test for crbug.com/702756
+// Test case excerpted from editing/undo/redo_correct_selection.html
+TEST_F(FrameSelectionTest, SelectInvalidPositionInFlatTreeDoesntCrash) {
+  SetBodyContent("foo<option><select></select></option>");
+  Element* body = GetDocument().body();
+  Element* select = GetDocument().QuerySelector("select");
+  Node* foo = body->firstChild();
+  Selection().SetSelection(SelectionInDOMTree::Builder()
+                               .Collapse(Position(body, 0))
+                               // SELECT@AfterAnchor is invalid in flat tree.
+                               .Extend(Position::AfterNode(select))
+                               .Build());
+  // Should not crash inside.
+  const VisibleSelectionInFlatTree& selection =
+      Selection().ComputeVisibleSelectionInFlatTree();
+
+  // This only records the current behavior. It might be changed in the future.
+  EXPECT_EQ(PositionInFlatTree(foo, 0), selection.Base());
+  EXPECT_EQ(PositionInFlatTree(foo, 0), selection.Extent());
+}
+
 }  // namespace blink