Fix selection painting crash.

Bug: 726980
Change-Id: I9b537749a96a617617fdddf98f71cafba4bf2833
Reviewed-on: https://chromium-review.googlesource.com/578462
Commit-Queue: Chris Harrelson <chrishtr@chromium.org>
Reviewed-by: Walter Korman <wkorman@chromium.org>
Cr-Commit-Position: refs/heads/master@{#488674}

third_party/WebKit/LayoutTests/paint/input/textarea-crash-expected.txt

+

third_party/WebKit/LayoutTests/paint/input/textarea-crash.html

+<!-- Passes if it does not crash. -->
+<textarea id="target">
+  Test text test text
+</textarea>
+<script>
+if (window.testRunner)
+  window.testRunner.dumpAsText();
+if (!window.eventSender) {
+  console.log('This test requires eventSender.');
+} else {
+  var x = target.offsetLeft + (target.offsetWidth / 2);
+  var y = target.offsetTop + (target.offsetHeight / 2);
+  eventSender.mouseMoveTo(x, y);
+  eventSender.mouseDown();
+  x = target.offsetLeft + target.offsetWidth + 5;
+  eventSender.mouseMoveTo(x, y);
+  eventSender.mouseUp();
+}
+</script>
+<style>
+textarea {
+  display: contents;
+}
+</style>

third_party/WebKit/Source/core/layout/LayoutObject.cpp

@@ -3049,8 +3049,10 @@ PassRefPtr<ComputedStyle> LayoutObject::GetUncachedSelectionStyle() const {
   if (ShadowRoot* root = GetNode()->ContainingShadowRoot()) {
     if (root->GetType() == ShadowRootType::kUserAgent) {
       if (Element* shadow_host = GetNode()->OwnerShadowHost()) {
-        return shadow_host->GetLayoutObject()->GetUncachedPseudoStyle(
-            PseudoStyleRequest(kPseudoIdSelection));
+        if (LayoutObject* obj = shadow_host->GetLayoutObject()) {
+          return obj->GetUncachedPseudoStyle(
+              PseudoStyleRequest(kPseudoIdSelection));
+        }
       }
     }
   }