Stop flat tree selection canonicalization from using invalid positions

third_party/WebKit/Source/core/editing/SelectionEditor.cpp

Index: third_party/WebKit/Source/core/editing/SelectionEditor.cpp
diff --git a/third_party/WebKit/Source/core/editing/SelectionEditor.cpp b/third_party/WebKit/Source/core/editing/SelectionEditor.cpp
index 29123c97f80d564b2f66645b87470175b6716b77..a5c9762f04054f4ca7e0741333bc5f22732eb09a 100644
--- a/third_party/WebKit/Source/core/editing/SelectionEditor.cpp
+++ b/third_party/WebKit/Source/core/editing/SelectionEditor.cpp
@@ -405,15 +405,21 @@ void SelectionEditor::UpdateCachedVisibleSelectionInFlatTreeIfNeeded() const {
     return;
   style_version_for_flat_tree_ = GetDocument().StyleVersion();
   cached_visible_selection_in_flat_tree_is_dirty_ = false;
-  cached_visible_selection_in_flat_tree_ = CreateVisibleSelection(
-      SelectionInFlatTree::Builder()
-          .SetBaseAndExtent(ToPositionInFlatTree(selection_.Base()),
-                            ToPositionInFlatTree(selection_.Extent()))
-          .SetAffinity(selection_.Affinity())
-          .SetHasTrailingWhitespace(selection_.HasTrailingWhitespace())
-          .SetGranularity(selection_.Granularity())
-          .SetIsDirectional(selection_.IsDirectional())
-          .Build());
+  SelectionInFlatTree::Builder builder;
+  const PositionInFlatTree& base = ToPositionInFlatTree(selection_.Base());
+  const PositionInFlatTree& extent = ToPositionInFlatTree(selection_.Extent());
+  if (base.IsNotNull() && extent.IsNotNull())
+    builder.SetBaseAndExtent(base, extent);
+  else if (base.IsNotNull())
+    builder.Collapse(base);
+  else if (extent.IsNotNull())
+    builder.Collapse(extent);
+  builder.SetAffinity(selection_.Affinity())
+      .SetHasTrailingWhitespace(selection_.HasTrailingWhitespace())
+      .SetGranularity(selection_.Granularity())
+      .SetIsDirectional(selection_.IsDirectional());
+  cached_visible_selection_in_flat_tree_ =
+      CreateVisibleSelection(builder.Build());
   if (!cached_visible_selection_in_flat_tree_.IsNone())
     return;
   style_version_for_dom_tree_ = GetDocument().StyleVersion();