[Android] Fix a crash in SuggestionMenuTimeoutCallback()

The possible crash senario is like following:
1) Regular SuggestionMarker with suggestions get clicked, timeout
   triggered.
2) IME removes original SuggestionMarker, then added another
   SuggestionMarker with no suggestion.
3) SuggestionMenuTimeoutCallback() get called.
4) Crash happens because we are getting the first suggestion in
   suggestion_infos vector.

This CL checks if suggestion_infos is empty to avoid the crash.

Bug: 901135, 869261
Change-Id: I5949c370e3cbc2c760502f7357ba5463c7d909bb
Reviewed-on: https://chromium-review.googlesource.com/c/1314130
Commit-Queue: Shimi Zhang <ctzsm@chromium.org>
Reviewed-by: Yoshifumi Inoue <yosin@chromium.org>
Reviewed-by: Changwan Ryu <changwan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#605003}

third_party/blink/renderer/core/editing/suggestion/text_suggestion_controller.cc

@@ -459,6 +459,9 @@ void TextSuggestionController::ShowSuggestionMenu(
 
   Vector<TextSuggestionInfo>& suggestion_infos =
       suggestion_infos_with_node_and_highlight_color.suggestion_infos;
+  if (suggestion_infos.IsEmpty())
+    return;
+
   int span_union_start = suggestion_infos[0].span_start;
   int span_union_end = suggestion_infos[0].span_end;
   for (wtf_size_t i = 1; i < suggestion_infos.size(); ++i) {

third_party/blink/renderer/core/editing/suggestion/text_suggestion_controller_test.cc

@@ -25,6 +25,25 @@ class TextSuggestionControllerTest : public EditingTestBase {
                     ->GetTextSuggestionController()
                     .text_suggestion_host_);
   }
+
+  void ShowSuggestionMenu(
+      const HeapVector<std::pair<Member<Node>, Member<DocumentMarker>>>&
+          node_suggestion_marker_pairs,
+      size_t max_number_of_suggestions) {
+    GetDocument().GetFrame()->GetTextSuggestionController().ShowSuggestionMenu(
+        node_suggestion_marker_pairs, max_number_of_suggestions);
+  }
+
+  EphemeralRangeInFlatTree ComputeRangeSurroundingCaret(
+      const PositionInFlatTree& caret_position) {
+    const Node* const position_node = caret_position.ComputeContainerNode();
+    const unsigned position_offset_in_node =
+        caret_position.ComputeOffsetInContainerNode();
+    // See ComputeRangeSurroundingCaret() in TextSuggestionController.
+    return EphemeralRangeInFlatTree(
+        PositionInFlatTree(position_node, position_offset_in_node - 1),
+        PositionInFlatTree(position_node, position_offset_in_node + 1));
+  }
 };
 
 TEST_F(TextSuggestionControllerTest, ApplySpellCheckSuggestion) {
@@ -477,6 +496,23 @@ TEST_F(TextSuggestionControllerTest, SuggestionMarkerWithEmptySuggestion) {
   // We don't trigger menu in this case so there shouldn't be any mojom
   // connection available.
   EXPECT_FALSE(IsTextSuggestionHostAvailable());
+
+  const VisibleSelectionInFlatTree& selection =
+      GetFrame().Selection().ComputeVisibleSelectionInFlatTree();
+  EXPECT_FALSE(selection.IsNone());
+
+  const EphemeralRangeInFlatTree& range_to_check =
+      ComputeRangeSurroundingCaret(selection.Start());
+
+  const HeapVector<std::pair<Member<Node>, Member<DocumentMarker>>>&
+      node_suggestion_marker_pairs =
+          GetFrame().GetDocument()->Markers().MarkersIntersectingRange(
+              range_to_check, DocumentMarker::MarkerTypes::Suggestion());
+  EXPECT_FALSE(node_suggestion_marker_pairs.IsEmpty());
+
+  // Calling ShowSuggestionMenu() shouldn't crash. See crbug.com/901135.
+  // ShowSuggestionMenu() may still get called because of race condition.
+  ShowSuggestionMenu(node_suggestion_marker_pairs, 3);
 }
 
 TEST_F(TextSuggestionControllerTest, SuggestionMarkerWithSuggestion) {