Stop flat tree selection canonicalization from using invalid positions

third_party/WebKit/Source/core/editing/FrameSelectionTest.cpp

Index: third_party/WebKit/Source/core/editing/FrameSelectionTest.cpp
diff --git a/third_party/WebKit/Source/core/editing/FrameSelectionTest.cpp b/third_party/WebKit/Source/core/editing/FrameSelectionTest.cpp
index b5a282ec1d995f8cf6a6ad0f0e39ff318e406bc2..7e08841bacf47f1dfb86226e0cdb1011cd06e081 100644
--- a/third_party/WebKit/Source/core/editing/FrameSelectionTest.cpp
+++ b/third_party/WebKit/Source/core/editing/FrameSelectionTest.cpp
@@ -328,4 +328,19 @@ TEST_F(FrameSelectionTest, SetSelectedRangePreservesHandle) {
          "selectSetSelectedRange they should be present after it.";
 }
 
+// Regression test for crbug.com/702756
+// Test case excerpted from editing/undo/redo_correct_selection.html
+TEST_F(FrameSelectionTest, SelectInvalidPositionInFlatTreeDoesntCrash) {
+  SetBodyContent("foo<option><select></select></option>");
+  Element* body = GetDocument().body();
+  Element* select = GetDocument().QuerySelector("select");
+  Selection().SetSelection(SelectionInDOMTree::Builder()
+                               .Collapse(Position(body, 0))
+                               // SELECT@AfterAnchor is invalid in flat tree.
+                               .Extend(Position::AfterNode(select))
+                               .Build());
+  // The test passes if it doesn't crash inside.
+  Selection().ComputeVisibleSelectionInFlatTree();

[yosin_UTC9, 2017/04/27 07:02:28]

nit: Let's have EXPECT_EQ() to compare expected VisibleSelectionInFlatTree for
recording current behavior.

[Xiaocheng, 2017/04/27 07:20:46]

The expected selection in flat tree should be '|foo'.

I guess it might be changed in the future?

+}
+
 }  // namespace blink