Stop crashing when VisibleSelections in DOM and Flat trees are inconsistent

third_party/WebKit/Source/core/editing/FrameSelectionTest.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/editing/FrameSelection.h"
 
 #include <memory>
 #include "bindings/core/v8/ExceptionState.h"
 #include "core/dom/Document.h"
 #include "core/dom/Element.h"
@@ skipping 945 matching lines @@
   EXPECT_TRUE(Selection().SelectionHasFocus());
   EXPECT_FALSE(Selection().IsHidden());
 
   Element* const alink = GetDocument().getElementById("alink");
   alink->focus();
   EXPECT_TRUE(Selection().GetSelectionInDOMTree().IsRange());
   EXPECT_FALSE(Selection().SelectionHasFocus());
   EXPECT_FALSE(Selection().IsHidden());  // Range still visible.
 }
 
+// crbug.com/725457
+TEST_F(FrameSelectionTest, InconsistentVisibleSelectionNoCrash) {
+  SetBodyContent("foo<div id=host><span id=anchor>bar</span></div>baz");
+  SetShadowContent("shadow", "host");
+
+  Element* anchor = GetDocument().getElementById("anchor");
+
+  // |start| and |end| are valid Positions in DOM tree, but do not participate
+  // in flat tree. They should be canonicalized to null VisiblePositions, but
+  // are currently not. See crbug.com/729636 for details.
+  const Position& start = Position::BeforeNode(anchor);
+  const Position& end = Position::AfterNode(anchor);
+  Selection().SetSelection(
+      SelectionInDOMTree::Builder().Collapse(start).Extend(end).Build());
+
+  // Shouldn't crash inside.
+  EXPECT_FALSE(Selection().SelectionHasFocus());
+}
+
 }  // namespace blink