ShadowRoot's getSelection().getRangeAt(0) returns an incorrect Range object

Source/core/editing/DOMSelection.cpp

Index: Source/core/editing/DOMSelection.cpp
diff --git a/Source/core/editing/DOMSelection.cpp b/Source/core/editing/DOMSelection.cpp
index 25703e256911f5e5673ad5af24a39089b115e0d4..76d1e5ebbe288eda38ac7c0662bb06d468ebeaa9 100644
--- a/Source/core/editing/DOMSelection.cpp
+++ b/Source/core/editing/DOMSelection.cpp
@@ -369,14 +369,13 @@ PassRefPtrWillBeRawPtr<Range> DOMSelection::getRangeAt(int index, ExceptionState
     // If you're hitting this, you've added broken multi-range selection support
     ASSERT(rangeCount() == 1);
 
-    if (Node* shadowAncestor = selectionShadowAncestor(m_frame)) {
-        ASSERT(!shadowAncestor->isShadowRoot());
-        ContainerNode* container = shadowAncestor->parentOrShadowHostNode();
-        int offset = shadowAncestor->nodeIndex();
-        return Range::create(shadowAncestor->document(), container, offset, container, offset);
-    }
+    Position anchor = anchorPosition(visibleSelection());
+    if (!anchor.anchorNode()->isInShadowTree())
+        return m_frame->selection().firstRange();
 
-    return m_frame->selection().firstRange();
+    if (!visibleSelection().isBaseFirst())
+        return Range::create(*anchor.document(), focusNode(), focusOffset(), shadowAdjustedNode(anchor), anchorOffset());

[Yuta Kitamura, 2015/01/07 07:50:57]

Does anchorOffset() work for shadowAdjustedNode(anchor)?

My understanding is that shadowAdjustedNode() may return
a Node in a different place, thus anchorOffset() may not
work if that happens.

[kojii, 2015/01/07 08:20:43]

Yes, this |anchorOffset()| is |DOMSelection::anchorOffset()|
https://code.google.com/p/chromium/codesearch#chromium/src/third_party/WebKit...

which gets offset from |shadowAdjustedNode()|.

In other words, this code actually calculates adjustedNode
twice -- once for node and once for offset within |anchorOffset()|,
which I tried to avoid in Patch Set 2, but Yosi preferred
to calculate twice to reduce the number of lines in this patch.

[Yuta Kitamura, 2015/01/07 08:47:54]

Okay, then the PS5 looks fine to me.

I don't have a strong preference on which of PS2 and PS5
is better (I somewhat agree that the PS2 has too much code
churn, while the correctness of this line in PS5 is not very
obvious). 

+    return Range::create(*anchor.document(), shadowAdjustedNode(anchor), anchorOffset(), focusNode(), focusOffset());
 }
 
 void DOMSelection::removeAllRanges()