Stop flat tree selection canonicalization from using invalid positions

third_party/WebKit/Source/core/editing/FrameSelectionTest.cpp

Index: third_party/WebKit/Source/core/editing/FrameSelectionTest.cpp
diff --git a/third_party/WebKit/Source/core/editing/FrameSelectionTest.cpp b/third_party/WebKit/Source/core/editing/FrameSelectionTest.cpp
index b5a282ec1d995f8cf6a6ad0f0e39ff318e406bc2..67b5b56b54dbad9f382ac7be1078763930e9ab19 100644
--- a/third_party/WebKit/Source/core/editing/FrameSelectionTest.cpp
+++ b/third_party/WebKit/Source/core/editing/FrameSelectionTest.cpp
@@ -328,4 +328,25 @@ TEST_F(FrameSelectionTest, SetSelectedRangePreservesHandle) {
          "selectSetSelectedRange they should be present after it.";
 }
 
+// Regression test for crbug.com/702756
+// Test case excerpted from editing/undo/redo_correct_selection.html
+TEST_F(FrameSelectionTest, SelectInvalidPositionInFlatTreeDoesntCrash) {
+  SetBodyContent("foo<option><select></select></option>");
+  Element* body = GetDocument().body();
+  Element* select = GetDocument().QuerySelector("select");
+  Node* foo = body->firstChild();
+  Selection().SetSelection(SelectionInDOMTree::Builder()
+                               .Collapse(Position(body, 0))
+                               // SELECT@AfterAnchor is invalid in flat tree.
+                               .Extend(Position::AfterNode(select))
+                               .Build());
+  // Should not crash inside.
+  const VisibleSelectionInFlatTree& selection =
+      Selection().ComputeVisibleSelectionInFlatTree();
+
+  // This only records the current behavior. It might be changed in the future.
+  EXPECT_EQ(PositionInFlatTree(foo, 0), selection.Base());
+  EXPECT_EQ(PositionInFlatTree(foo, 0), selection.Extent());
+}
+
 }  // namespace blink