Stop flat tree selection canonicalization from using invalid positions

third_party/WebKit/Source/core/editing/Position.cpp

 /*
  * Copyright (C) 2004, 2005, 2006, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 526 matching lines @@
     // children of shadow host.
     // e.g. "foo",0 in <progress>foo</progress>
     if (anchor->IsShadowRoot())
       return PositionInFlatTree(anchor->OwnerShadowHost(),
                                 PositionAnchorType::kAfterChildren);
     return PositionInFlatTree(anchor, PositionAnchorType::kAfterChildren);
   }
 
   if (anchor->IsShadowRoot())
     return PositionInFlatTree(anchor->OwnerShadowHost(), pos.AnchorType());
+  if (pos.IsBeforeAnchor() || pos.IsAfterAnchor()) {
+    if (anchor->CanParticipateInFlatTree() &&
+        !FlatTreeTraversal::Parent(*anchor)) {
+      // For Before/AfterAnchor, if |anchor| doesn't have parent in the flat
+      // tree, there is no valid corresponding PositionInFlatTree.
+      // Since this function is a primitive function, we do not adjust |pos|
+      // to somewhere else in flat tree.
+      // Reached by unit test
+      // FrameSelectionTest.SelectInvalidPositionInFlatTreeDoesntCrash.
+      return PositionInFlatTree();
+    }
+  }
   // TODO(yosin): Once we have a test case for SLOT or active insertion point,
   // this function should handle it.
   return PositionInFlatTree(anchor, pos.AnchorType());
 }
 
 Position ToPositionInDOMTree(const Position& position) {
   return position;
 }
 
 Position ToPositionInDOMTree(const PositionInFlatTree& position) {
@@ skipping 125 matching lines @@
 }
 
 void showTree(const blink::Position* pos) {
   if (pos)
     pos->ShowTreeForThis();
   else
     LOG(INFO) << "Cannot showTree for <null>";
 }
 
 #endif