ShadowRoot's getSelection().getRangeAt(0) returns an incorrect Range object

Source/core/editing/DOMSelection.cpp

Index: Source/core/editing/DOMSelection.cpp
diff --git a/Source/core/editing/DOMSelection.cpp b/Source/core/editing/DOMSelection.cpp
index 25703e256911f5e5673ad5af24a39089b115e0d4..b6578c7ec0a01f7993a42322b8ebe7f4636407d9 100644
--- a/Source/core/editing/DOMSelection.cpp
+++ b/Source/core/editing/DOMSelection.cpp
@@ -369,14 +369,12 @@ PassRefPtrWillBeRawPtr<Range> DOMSelection::getRangeAt(int index, ExceptionState
     // If you're hitting this, you've added broken multi-range selection support
     ASSERT(rangeCount() == 1);
 
-    if (Node* shadowAncestor = selectionShadowAncestor(m_frame)) {
-        ASSERT(!shadowAncestor->isShadowRoot());
-        ContainerNode* container = shadowAncestor->parentOrShadowHostNode();
-        int offset = shadowAncestor->nodeIndex();
-        return Range::create(shadowAncestor->document(), container, offset, container, offset);
-    }
+    if (!m_treeScope->rootNode().isShadowRoot())
+        return m_frame->selection().firstRange();
 
-    return m_frame->selection().firstRange();
+    Node* anchor = anchorNode();
+    ASSERT(anchor);

[yosin_UTC9, 2015/01/07 01:06:29]

I think we don't need to |ASSERT(anchor)| here. We've got null pointer exception
in somewhere in |Range::create()| and we can get stack trace from crash log or
Clusterfuzz.

[kojii, 2015/01/07 06:53:52]

Done.

+    return Range::create(anchor->document(), anchor, anchorOffset(), focusNode(), focusOffset());
 }
 
 void DOMSelection::removeAllRanges()