Code: bool FrameSelection::SetSelectionDeprecated(
    const SelectionInDOMTree& passed_selection,
    const SetSelectionData& options) {
  DCHECK(IsAvailable());
  passed_selection.AssertValidFor(GetDocument());

  SelectionInDOMTree::Builder builder(passed_selection);
  if (ShouldAlwaysUseDirectionalSelection(frame_))
    builder.SetIsDirectional(true);
  SelectionInDOMTree new_selection = builder.Build();
  if (granularity_strategy_ && !options.DoNotClearStrategy())
    granularity_strategy_->Clear();
  granularity_ = options.Granularity();

  if (options.ShouldCloseTyping())
    TypingCommand::CloseTyping(frame_);

  if (options.ShouldClearTypingStyle())
    frame_->GetEditor().ClearTypingStyle();
 
   const SelectionInDOMTree old_selection_in_dom_tree =
       selection_editor_->GetSelectionInDOMTree();
  if (old_selection_in_dom_tree == new_selection)
     return false;
  selection_editor_->SetSelection(new_selection);
   ScheduleVisualUpdateForPaintInvalidationIfNeeded();
 
   const Document& current_document = GetDocument();
  frame_->GetEditor().RespondToChangedSelection(
      old_selection_in_dom_tree.ComputeStartPosition(),
      options.ShouldCloseTyping() ? TypingContinuation::kEnd
                                  : TypingContinuation::kContinue);
  DCHECK_EQ(current_document, GetDocument());
  return true;
}

Vulnerability Type: DoS Overflow 
CWE ID: CWE-119
Summary: The convolution implementation in Skia, as used in Google Chrome before 47.0.2526.73, does not properly constrain row lengths, which allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via crafted graphics data.
Commit Message: Move SelectionTemplate::is_handle_visible_ to FrameSelection

This patch moves |is_handle_visible_| to |FrameSelection| from |SelectionTemplate|
since handle visibility is used only for setting |FrameSelection|, hence it is
a redundant member variable of |SelectionTemplate|.

Bug: 742093
Change-Id: I3add4da3844fb40be34dcb4d4b46b5fa6fed1d7e
Reviewed-on: https://chromium-review.googlesource.com/595389
Commit-Queue: Yoshifumi Inoue <yosin@chromium.org>
Reviewed-by: Xiaocheng Hu <xiaochengh@chromium.org>
Reviewed-by: Kent Tamura <tkent@chromium.org>
Cr-Commit-Position: refs/heads/master@{#491660}