Abort InsertTextCommand if there is no VisibleSelection after deleting selection

InsertTextCommand deletes the content of the current selected range
before inserting new text. In certain cases, there is non-null selection
after the deletion, but the corresponding VisibleSelection is null. This
patch makes InsertTextCommand abort in such cases to avoid crashing.

Bug: 779376
Change-Id: I84538fe1ccd4200e9505701e7cbe700c48ea101a
Reviewed-on: https://chromium-review.googlesource.com/744388
Commit-Queue: Yoshifumi Inoue <yosin@chromium.org>
Reviewed-by: Yoshifumi Inoue <yosin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#512737}

third_party/WebKit/Source/core/editing/commands/InsertTextCommand.cpp

@@ -191,6 +191,9 @@ void InsertTextCommand::DoApply(EditingState* editing_state) {
 
   GetDocument().UpdateStyleAndLayoutIgnorePendingStylesheets();
 
+  // Reached by InsertTextCommandTest.NoVisibleSelectionAfterDeletingSelection
+  ABORT_EDITING_COMMAND_IF(EndingVisibleSelection().IsNone());
+
   Position start_position(EndingVisibleSelection().Start());
 
   Position placeholder;

third_party/WebKit/Source/core/editing/commands/InsertTextCommandTest.cpp

@@ -188,4 +188,29 @@ TEST_F(InsertTextCommandTest, WhitespaceFixupAfterParagraph) {
             GetSelectionTextFromBody(Selection().GetSelectionInDOMTree()));
 }
 
+// http://crbug.com/779376
+TEST_F(InsertTextCommandTest, NoVisibleSelectionAfterDeletingSelection) {
+  InsertStyleElement(
+      "ruby {display: inline-block; height: 100%}"
+      "navi {float: left}");
+  Selection().SetSelection(
+      SetSelectionTextToBody("<div contenteditable>"
+                             "  <ruby><strike>"
+                             "    <navi></navi>"
+                             "    <rtc>^&#xbbc3;&#xff17;&#x8e99;&#x1550;</rtc>"
+                             "  </strike></ruby>"
+                             "  <hr>|"
+                             "</div>"));
+  // Shouldn't crash inside
+  GetDocument().execCommand("insertText", false, "x", ASSERT_NO_EXCEPTION);
+  // This is only for recording the current behavior, which can be changed.
+  EXPECT_EQ(
+      "<div contenteditable>"
+      "  <ruby><strike>"
+      "    <navi></navi>"
+      "    ^</strike></ruby>"
+      "|</div>",
+      GetSelectionTextFromBody(Selection().GetSelectionInDOMTree()));
+}
+
 }  // namespace blink