Stop CaretDisplayItemClient from crashing when no LocalCaretRect is found

There is no guarantee that LocalCaretRectOfPosition() never returns a
non-null LayoutObject. Instead, callers should handle the null result
to avoid crashing.

This patch adds handling to CaretDisplayItemClient::ComputeCaretRect().

Bug: 881613
Cq-Include-Trybots: luci.chromium.try:linux_layout_tests_layout_ng
Change-Id: I1845b29a0cd43fb189a13561ee83c3641320df3c
Reviewed-on: https://chromium-review.googlesource.com/1217072Reviewed-by: Koji Ishii <kojii@chromium.org>
Reviewed-by: Emil A Eklund <eae@chromium.org>
Reviewed-by: Yoichi Osato <yoichio@chromium.org>
Commit-Queue: Xiaocheng Hu <xiaochengh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#590142}

third_party/blink/renderer/core/editing/caret_display_item_client.cc

@@ -104,6 +104,8 @@ LayoutRect CaretDisplayItemClient::ComputeCaretRect(
 
   // First compute a rect local to the layoutObject at the selection start.
   const LocalCaretRect& caret_rect = LocalCaretRectOfPosition(caret_position);
+  if (!caret_rect.layout_object)
+    return LayoutRect();
 
   // Get the layoutObject that will be responsible for painting the caret
   // (which is either the layoutObject we just found, or one of its containers).

third_party/blink/renderer/core/editing/caret_display_item_client.h

@@ -28,6 +28,7 @@
 #define THIRD_PARTY_BLINK_RENDERER_CORE_EDITING_CARET_DISPLAY_ITEM_CLIENT_H_
 
 #include "base/macros.h"
+#include "third_party/blink/renderer/core/core_export.h"
 #include "third_party/blink/renderer/core/editing/forward.h"
 #include "third_party/blink/renderer/platform/geometry/int_rect.h"
 #include "third_party/blink/renderer/platform/geometry/layout_rect.h"
@@ -41,7 +42,7 @@ class GraphicsContext;
 class LayoutBlock;
 struct PaintInvalidatorContext;
 
-class CaretDisplayItemClient final : public DisplayItemClient {
+class CORE_EXPORT CaretDisplayItemClient final : public DisplayItemClient {
  public:
   CaretDisplayItemClient();
   ~CaretDisplayItemClient() override;

third_party/blink/renderer/core/editing/caret_display_item_client_test.cc

@@ -8,6 +8,7 @@
 #include "testing/gmock/include/gmock/gmock.h"
 #include "third_party/blink/renderer/core/editing/frame_selection.h"
 #include "third_party/blink/renderer/core/editing/selection_template.h"
+#include "third_party/blink/renderer/core/editing/testing/editing_test_base.h"
 #include "third_party/blink/renderer/core/frame/local_frame_view.h"
 #include "third_party/blink/renderer/core/html_names.h"
 #include "third_party/blink/renderer/core/layout/layout_view.h"
@@ -371,4 +372,26 @@ TEST_P(CaretDisplayItemClientTest, CompositingChange) {
             GetCaretDisplayItemClient().VisualRect());
 }
 
+class ParameterizedComputeCaretRectTest
+    : public EditingTestBase,
+      private ScopedLayoutNGForTest,
+      public testing::WithParamInterface<bool> {
+ public:
+  ParameterizedComputeCaretRectTest() : ScopedLayoutNGForTest(GetParam()) {}
+};
+
+INSTANTIATE_TEST_CASE_P(All,
+                        ParameterizedComputeCaretRectTest,
+                        testing::Bool());
+
+TEST_P(ParameterizedComputeCaretRectTest, CaretRectAfterEllipsisNoCrash) {
+  SetBodyInnerHTML(
+      "<style>pre{width:30px; overflow:hidden; text-overflow:ellipsis}</style>"
+      "<pre id=target>long long long long long long text</pre>");
+  const Node* text = GetElementById("target")->firstChild();
+  const Position position = Position::LastPositionInNode(*text);
+  // Shouldn't crash inside. The actual result doesn't matter and may change.
+  CaretDisplayItemClient::ComputeCaretRect(PositionWithAffinity(position));
+}
+
 }  // namespace blink