ShadowRoot's getSelection().getRangeAt(0) returns an incorrect Range object

Source/core/editing/DOMSelection.cpp

 /*
  * Copyright (C) 2007, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
@@ skipping 351 matching lines @@
         return nullptr;
 
     if (index < 0 || index >= rangeCount()) {
         exceptionState.throwDOMException(IndexSizeError, String::number(index) + " is not a valid index.");
         return nullptr;
     }
 
     // If you're hitting this, you've added broken multi-range selection support
     ASSERT(rangeCount() == 1);
 
-    if (Node* shadowAncestor = selectionShadowAncestor(m_frame)) {
-        ASSERT(!shadowAncestor->isShadowRoot());
-        ContainerNode* container = shadowAncestor->parentOrShadowHostNode();
-        int offset = shadowAncestor->nodeIndex();
-        return Range::create(shadowAncestor->document(), container, offset, container, offset);
-    }
+    if (!m_treeScope->rootNode().isShadowRoot())
+        return m_frame->selection().firstRange();
 
-    return m_frame->selection().firstRange();
+    Node* anchor = anchorNode();
+    ASSERT(anchor);

[yosin_UTC9, 2015/01/07 01:06:29]

I think we don't need to |ASSERT(anchor)| here. We've got null pointer exception
in somewhere in |Range::create()| and we can get stack trace from crash log or
Clusterfuzz.

[kojii, 2015/01/07 06:53:52]

Done.

+    return Range::create(anchor->document(), anchor, anchorOffset(), focusNode(), focusOffset());
 }
 
 void DOMSelection::removeAllRanges()
 {
     if (!m_frame)
         return;
     m_frame->selection().clear();
 }
 
 void DOMSelection::addRange(Range* newRange)
@@ skipping 169 matching lines @@
         m_treeScope->document().addConsoleMessage(ConsoleMessage::create(JSMessageSource, ErrorMessageLevel, message));
 }
 
 void DOMSelection::trace(Visitor* visitor)
 {
     visitor->trace(m_treeScope);
     DOMWindowProperty::trace(visitor);
 }
 
 } // namespace blink