Code: void TypingCommand::insertText(Document& document,
                               const String& text,
                               const VisibleSelection& selectionForInsertion,
                               Options options,
                               TextCompositionType compositionType,
                               const bool isIncrementalInsertion) {
   LocalFrame* frame = document.frame();
   DCHECK(frame);
 
   VisibleSelection currentSelection =
       frame->selection().computeVisibleSelectionInDOMTreeDeprecated();
 
   String newText = text;
   if (compositionType != TextCompositionUpdate)
    newText = dispatchBeforeTextInsertedEvent(text, selectionForInsertion);

  if (compositionType == TextCompositionConfirm) {
    if (dispatchTextInputEvent(frame, newText) !=
        DispatchEventResult::NotCanceled)
      return;
  }

  if (selectionForInsertion.isCaret() && newText.isEmpty())
    return;

  document.updateStyleAndLayoutIgnorePendingStylesheets();

  const PlainTextRange selectionOffsets = getSelectionOffsets(frame);
  if (selectionOffsets.isNull())
    return;
  const size_t selectionStart = selectionOffsets.start();

  if (TypingCommand* lastTypingCommand =
          lastTypingCommandIfStillOpenForTyping(frame)) {
    if (lastTypingCommand->endingSelection() != selectionForInsertion) {
      lastTypingCommand->setStartingSelection(selectionForInsertion);
      lastTypingCommand->setEndingVisibleSelection(selectionForInsertion);
    }

    lastTypingCommand->setCompositionType(compositionType);
    lastTypingCommand->setShouldRetainAutocorrectionIndicator(
        options & RetainAutocorrectionIndicator);
    lastTypingCommand->setShouldPreventSpellChecking(options &
                                                     PreventSpellChecking);
    lastTypingCommand->m_isIncrementalInsertion = isIncrementalInsertion;
    lastTypingCommand->m_selectionStart = selectionStart;

    EditingState editingState;
    EventQueueScope eventQueueScope;
    lastTypingCommand->insertText(newText, options & SelectInsertedText,
                                  &editingState);
    return;
  }

  TypingCommand* command = TypingCommand::create(document, InsertText, newText,
                                                 options, compositionType);
  bool changeSelection = selectionForInsertion != currentSelection;
  if (changeSelection) {
    command->setStartingSelection(selectionForInsertion);
    command->setEndingVisibleSelection(selectionForInsertion);
  }
  command->m_isIncrementalInsertion = isIncrementalInsertion;
  command->m_selectionStart = selectionStart;
  command->apply();

  if (changeSelection) {
    command->setEndingVisibleSelection(currentSelection);
    frame->selection().setSelection(currentSelection.asSelection());
  }
}

Vulnerability Type: DoS 
CWE ID: 
Summary: Use-after-free vulnerability in Blink, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging incorrect ordering of operations in the Web SQL Database thread relative to Blink's main thread, related to the shutdown function in web/WebKit.cpp.
Commit Message: Make TypingCommand::insertText() to take SelectionInDOMTree instead of VisibleSelection

This patch makes |TypingCommand::insertText()| to take |SelectionInDOMTree|
instead of |VisibleSelection| to reduce usage of |VisibleSelection| for
improving code health.

BUG=657237
TEST=n/a

Review-Url: https://codereview.chromium.org/2733183002
Cr-Commit-Position: refs/heads/master@{#455368}