Code: void SelectionController::SetNonDirectionalSelectionIfNeeded(
    const SelectionInFlatTree& passed_selection,
    TextGranularity granularity,
    EndPointsAdjustmentMode endpoints_adjustment_mode,
    HandleVisibility handle_visibility) {
  GetDocument().UpdateStyleAndLayoutIgnorePendingStylesheets();

  const VisibleSelectionInFlatTree& new_selection =
      CreateVisibleSelection(passed_selection);
  const PositionInFlatTree& base_position =
      original_base_in_flat_tree_.GetPosition();
  const VisiblePositionInFlatTree& original_base =
      base_position.IsConnected() ? CreateVisiblePosition(base_position)
                                  : VisiblePositionInFlatTree();
  const VisiblePositionInFlatTree& base =
      original_base.IsNotNull() ? original_base
                                : CreateVisiblePosition(new_selection.Base());
  const VisiblePositionInFlatTree& extent =
      CreateVisiblePosition(new_selection.Extent());
  const SelectionInFlatTree& adjusted_selection =
      endpoints_adjustment_mode == kAdjustEndpointsAtBidiBoundary
          ? AdjustEndpointsAtBidiBoundary(base, extent)
          : SelectionInFlatTree::Builder()
                .SetBaseAndExtent(base.DeepEquivalent(),
                                  extent.DeepEquivalent())
                .Build();

  SelectionInFlatTree::Builder builder(new_selection.AsSelection());
  if (adjusted_selection.Base() != base.DeepEquivalent() ||
      adjusted_selection.Extent() != extent.DeepEquivalent()) {
    original_base_in_flat_tree_ = base.ToPositionWithAffinity();
    SetContext(&GetDocument());
    builder.SetBaseAndExtent(adjusted_selection.Base(),
                             adjusted_selection.Extent());
  } else if (original_base.IsNotNull()) {
    if (CreateVisiblePosition(
            Selection().ComputeVisibleSelectionInFlatTree().Base())
            .DeepEquivalent() ==
        CreateVisiblePosition(new_selection.Base()).DeepEquivalent()) {
      builder.SetBaseAndExtent(original_base.DeepEquivalent(),
                               new_selection.Extent());
    }
     original_base_in_flat_tree_ = PositionInFlatTreeWithAffinity();
   }
 
  builder.SetIsHandleVisible(handle_visibility == HandleVisibility::kVisible);
   const SelectionInFlatTree& selection_in_flat_tree = builder.Build();
   if (Selection().ComputeVisibleSelectionInFlatTree() ==
           CreateVisibleSelection(selection_in_flat_tree) &&
      Selection().IsHandleVisible() == selection_in_flat_tree.IsHandleVisible())
     return;
   Selection().SetSelection(
       ConvertToSelectionInDOMTree(selection_in_flat_tree),
      SetSelectionData::Builder()
          .SetShouldCloseTyping(true)
           .SetShouldClearTypingStyle(true)
           .SetCursorAlignOnScroll(CursorAlignOnScroll::kIfNeeded)
           .SetGranularity(granularity)
           .Build());
 }

Vulnerability Type: DoS Overflow 
CWE ID: CWE-119
Summary: The convolution implementation in Skia, as used in Google Chrome before 47.0.2526.73, does not properly constrain row lengths, which allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via crafted graphics data.
Commit Message: Move SelectionTemplate::is_handle_visible_ to FrameSelection

This patch moves |is_handle_visible_| to |FrameSelection| from |SelectionTemplate|
since handle visibility is used only for setting |FrameSelection|, hence it is
a redundant member variable of |SelectionTemplate|.

Bug: 742093
Change-Id: I3add4da3844fb40be34dcb4d4b46b5fa6fed1d7e
Reviewed-on: https://chromium-review.googlesource.com/595389
Commit-Queue: Yoshifumi Inoue <yosin@chromium.org>
Reviewed-by: Xiaocheng Hu <xiaochengh@chromium.org>
Reviewed-by: Kent Tamura <tkent@chromium.org>
Cr-Commit-Position: refs/heads/master@{#491660}