Abort formatBlock command when SelectionForParagraphIteration() errs

The editing command requires SelectionForParagraphIteration() to figure
out the correct paragraph range, which however may fail due to invalid
input. This patch makes the command abort so that it doesn't crash the
renderer.

Bug: 873084
Cq-Include-Trybots: luci.chromium.try:linux_layout_tests_layout_ng
Change-Id: I86c77903e218ff4b564bce9122315b99896b01ed
Reviewed-on: https://chromium-review.googlesource.com/1175244Reviewed-by: Yoshifumi Inoue <yosin@chromium.org>
Commit-Queue: Xiaocheng Hu <xiaochengh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#583128}

third_party/blink/renderer/core/editing/commands/apply_block_element_command.cc

@@ -89,6 +89,8 @@ void ApplyBlockElementCommand::DoApply(EditingState* editing_state) {
     if (new_end.IsNotNull())
       builder.Extend(new_end);
     SetEndingSelection(SelectionForUndoStep::From(builder.Build()));
+    ABORT_EDITING_COMMAND_IF(EndingVisibleSelection().VisibleStart().IsNull());
+    ABORT_EDITING_COMMAND_IF(EndingVisibleSelection().VisibleEnd().IsNull());
   }
 
   VisibleSelection selection =

third_party/blink/renderer/core/editing/commands/apply_block_element_command_test.cc

@@ -145,4 +145,24 @@ TEST_F(ApplyBlockElementCommandTest, FormatBlockCrossingUserModifyBoundary) {
       GetSelectionTextFromBody());
 }
 
+// https://crbug.com/873084
+TEST_F(ApplyBlockElementCommandTest,
+       FormatBlockWithTableCrossingUserModifyBoundary) {
+  InsertStyleElement("*{-webkit-user-modify:read-write}");
+  Selection().SetSelection(
+      SetSelectionTextToBody("^<table></table>"
+                             "<kbd "
+                             "style=\"-webkit-user-modify:read-only\"><button><"
+                             "/button></kbd>|"),
+      SetSelectionOptions());
+  FormatBlockCommand* command =
+      FormatBlockCommand::Create(GetDocument(), HTMLNames::preTag);
+  // Shouldn't crash here.
+  EXPECT_FALSE(command->Apply());
+  EXPECT_EQ(
+      "<table>^</table>"
+      "<kbd style=\"-webkit-user-modify:read-only\"><button>|</button></kbd>",
+      GetSelectionTextFromBody());
+}
+
 }  // namespace blink

third_party/blink/renderer/core/editing/commands/editing_commands_utilities.cc

@@ -451,6 +451,7 @@ VisibleSelection SelectionForParagraphIteration(
   // we'll want modify is the last one inside the table, not the table itself (a
   // table is itself a paragraph).
   if (Element* table = TableElementJustBefore(end_of_selection)) {
+    DCHECK(start_of_selection.IsNotNull()) << new_selection;
     if (start_of_selection.DeepEquivalent().AnchorNode()->IsDescendantOf(
             table)) {
       const VisiblePosition& new_end =
@@ -475,6 +476,7 @@ VisibleSelection SelectionForParagraphIteration(
   // want to modify is the first one inside the table, not the paragraph
   // containing the table itself.
   if (Element* table = TableElementJustAfter(start_of_selection)) {
+    DCHECK(end_of_selection.IsNotNull()) << new_selection;
     if (end_of_selection.DeepEquivalent().AnchorNode()->IsDescendantOf(table)) {
       const VisiblePosition new_start =
           NextPositionOf(start_of_selection, kCannotCrossEditingBoundary);