The selection bounds should be clipped to the viewport

Source/core/editing/FrameSelection.cpp

 /*
  * Copyright (C) 2004, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 1697 matching lines @@
     return extractSelectedText(*this, TextIteratorDefaultBehavior);
 }
 
 String FrameSelection::selectedTextForClipboard() const
 {
     if (m_frame->settings() && m_frame->settings()->selectionIncludesAltImageText())
         return extractSelectedText(*this, TextIteratorEmitsImageAltText);
     return selectedText();
 }
 
-FloatRect FrameSelection::bounds() const
+LayoutRect FrameSelection::bounds() const
+{
+    FrameView* view = m_frame->view();
+    if (!view)
+        return LayoutRect();
+
+    return intersection(unclippedBounds(), view->visibleContentRect());
+}
+
+LayoutRect FrameSelection::unclippedBounds() const
 {
     m_frame->document()->updateRenderTreeIfNeeded();
 
     FrameView* view = m_frame->view();
     RenderView* renderView = m_frame->contentRenderer();
 
     if (!view || !renderView)
-        return FloatRect();
+        return LayoutRect();
 
-    LayoutRect selectionRect = renderView->selectionBounds();
-    return selectionRect;
+    return renderView->selectionBounds();
 }
 
 static inline HTMLFormElement* associatedFormElement(HTMLElement& element)
 {
     if (isHTMLFormElement(element))
         return &toHTMLFormElement(element);
     return element.formOwner();
 }
 
 // Scans logically forward from "start", including any child frames.
@@ skipping 40 matching lines @@
 {
     LayoutRect rect;
 
     switch (selectionType()) {
     case NoSelection:
         return;
     case CaretSelection:
         rect = absoluteCaretBounds();
         break;
     case RangeSelection:
-        rect = revealExtentOption == RevealExtent ? VisiblePosition(extent()).absoluteCaretBounds() : enclosingIntRect(bounds());
+        rect = revealExtentOption == RevealExtent ? VisiblePosition(extent()).absoluteCaretBounds() : enclosingIntRect(unclippedBounds());
         break;
     }
 
     Position start = this->start();
     ASSERT(start.deprecatedNode());
     if (start.deprecatedNode() && start.deprecatedNode()->renderer()) {
         // FIXME: This code only handles scrolling the startContainer's layer, but
         // the selection rect could intersect more than just that.
         // See <rdar://problem/4799899>.
         if (start.deprecatedNode()->renderer()->scrollRectToVisible(rect, alignment, alignment))
@@ skipping 131 matching lines @@
     sel.showTreeForThis();
 }
 
 void showTree(const blink::FrameSelection* sel)
 {
     if (sel)
         sel->showTreeForThis();
 }
 
 #endif