Code: void FrameSelection::MoveRangeSelection(const VisiblePosition& base_position,
                                        const VisiblePosition& extent_position,
                                        TextGranularity granularity) {
  SelectionInDOMTree new_selection =
      SelectionInDOMTree::Builder()
           .SetBaseAndExtentDeprecated(base_position.DeepEquivalent(),
                                       extent_position.DeepEquivalent())
           .SetAffinity(base_position.Affinity())
          .SetIsHandleVisible(IsHandleVisible())
           .Build();
 
   if (new_selection.IsNone())
    return;

  const VisibleSelection& visible_selection =
      CreateVisibleSelectionWithGranularity(new_selection, granularity);
  if (visible_selection.IsNone())
    return;

  SelectionInDOMTree::Builder builder;
  if (visible_selection.IsBaseFirst()) {
    builder.SetBaseAndExtent(visible_selection.Start(),
                             visible_selection.End());
  } else {
    builder.SetBaseAndExtent(visible_selection.End(),
                              visible_selection.Start());
   }
   builder.SetAffinity(visible_selection.Affinity());
  builder.SetIsHandleVisible(IsHandleVisible());
   SetSelection(builder.Build(), SetSelectionData::Builder()
                                     .SetShouldCloseTyping(true)
                                     .SetShouldClearTypingStyle(true)
                                     .SetGranularity(granularity)
                                     .Build());
 }

Vulnerability Type: DoS Overflow 
CWE ID: CWE-119
Summary: The convolution implementation in Skia, as used in Google Chrome before 47.0.2526.73, does not properly constrain row lengths, which allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via crafted graphics data.
Commit Message: Move SelectionTemplate::is_handle_visible_ to FrameSelection

This patch moves |is_handle_visible_| to |FrameSelection| from |SelectionTemplate|
since handle visibility is used only for setting |FrameSelection|, hence it is
a redundant member variable of |SelectionTemplate|.

Bug: 742093
Change-Id: I3add4da3844fb40be34dcb4d4b46b5fa6fed1d7e
Reviewed-on: https://chromium-review.googlesource.com/595389
Commit-Queue: Yoshifumi Inoue <yosin@chromium.org>
Reviewed-by: Xiaocheng Hu <xiaochengh@chromium.org>
Reviewed-by: Kent Tamura <tkent@chromium.org>
Cr-Commit-Position: refs/heads/master@{#491660}