Fix Android renderer crash when long-pressing certain markup

Long-pressing on a webpage in Android calls
SelectionController::SelectClosestWordFromHitTestResult(), which calls
CreateVisibleSelectionWithGranularity() to attempt to select the closest word.
In some cases, this creates an invalid range (which ends before it starts),
which causes a crash. This is currently the #3 top renderer crash in Chrome 61
for Android. This CL adds a check for an invalid selection range to avoid a
crash that we can merge into the M62 release. We should properly fix
CreateVisibleSelectionWithGranularity() at a later point to not return invalid
ranges.

Bug: 735774
Change-Id: If035606403df9f3d13961e49dce80f0129b96318
Reviewed-on: https://chromium-review.googlesource.com/691060
Commit-Queue: Ryan Landay <rlanday@chromium.org>
Reviewed-by: Yoshifumi Inoue <yosin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#505283}

third_party/WebKit/Source/core/editing/SelectionController.cpp

@@ -561,6 +561,12 @@ bool SelectionController::SelectClosestWordFromHitTestResult(
                             TextGranularity::kWord)
                       : VisibleSelectionInFlatTree();
 
+  // TODO(editing-dev): Fix CreateVisibleSelectionWithGranularity() to not
+  // return invalid ranges. Until we do that, we need this check here to avoid a
+  // renderer crash when we call PlainText() below (see crbug.com/735774).
+  if (new_selection.IsNone() || new_selection.Start() > new_selection.End())
+    return false;
+
   HandleVisibility visibility = HandleVisibility::kNotVisible;
   if (select_input_event_type == SelectInputEventType::kTouch) {
     // If node doesn't have text except space, tab or line break, do not