Avoid CachedTextInputInfo::GetPlainTextRange() to crash

This patch changes |CachedTextInputInfo::GetPlainTextRange()| to return
empty |PlainTextRange| when passed range is outside of cached text to
avoid crash when selection moved during IME text composition.

This case is happend with following scenario:
1. Start IME text composition
2. Move selection to another content editable
3. |InputMethodController::TextInputInfo()| in
   |FrameSelection::SetSelection()|.
4. |InputMethodController::WillChangeFocus()| is called to clear IME
   text composition from |FocusController|.

Bug: 1157910, 1161562
Change-Id: I38ed328558a572388d9e715dd6f6cae481b868e3
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2626624
Commit-Queue: Koji Ishii <kojii@chromium.org>
Auto-Submit: Yoshifumi Inoue <yosin@chromium.org>
Reviewed-by: Koji Ishii <kojii@chromium.org>
Cr-Commit-Position: refs/heads/master@{#842934}

third_party/blink/renderer/core/editing/ime/cached_text_input_info.cc

@@ -108,16 +108,21 @@ PlainTextRange CachedTextInputInfo::GetPlainTextRange(
     const EphemeralRange& range) const {
   if (range.IsNull())
     return PlainTextRange();
-  const unsigned start_offset = RangeLength(
-      EphemeralRange(Position(*container_, 0), range.StartPosition()));
+  const Position container_start = Position(*container_, 0);
+  // When selection is moved to another editable during IME composition,
+  // |range| may not in |container|. See http://crbug.com/1161562
+  if (container_start > range.StartPosition())
+    return PlainTextRange();
+  const unsigned start_offset =
+      RangeLength(EphemeralRange(container_start, range.StartPosition()));
   const unsigned end_offset =
-      range.IsCollapsed() ? start_offset
-                          : RangeLength(EphemeralRange(Position(*container_, 0),
-                                                       range.EndPosition()));
-  DCHECK_EQ(static_cast<unsigned>(TextIterator::RangeLength(
-                EphemeralRange(Position(*container_, 0), range.EndPosition()),
-                Behavior())),
-            end_offset);
+      range.IsCollapsed()
+          ? start_offset
+          : RangeLength(EphemeralRange(container_start, range.EndPosition()));
+  DCHECK_EQ(
+      static_cast<unsigned>(TextIterator::RangeLength(
+          EphemeralRange(container_start, range.EndPosition()), Behavior())),
+      end_offset);
   return PlainTextRange(start_offset, end_offset);
 }