Code: bool InputMethodController::FinishComposingText(
    ConfirmCompositionBehavior confirm_behavior) {
  if (!HasComposition())
    return false;

  const bool is_too_long = IsTextTooLongAt(composition_range_->StartPosition());

  const String& composing = ComposingText();

  if (confirm_behavior == kKeepSelection) {
    const bool is_handle_visible = GetFrame().Selection().IsHandleVisible();

    const PlainTextRange& old_offsets = GetSelectionOffsets();
    Editor::RevealSelectionScope reveal_selection_scope(&GetEditor());

    if (is_too_long) {
      ReplaceComposition(ComposingText());
    } else {
      Clear();
      DispatchCompositionEndEvent(GetFrame(), composing);
    }

    GetDocument().UpdateStyleAndLayoutIgnorePendingStylesheets();

    const EphemeralRange& old_selection_range =
        EphemeralRangeForOffsets(old_offsets);
    if (old_selection_range.IsNull())
      return false;
     const SelectionInDOMTree& selection =
         SelectionInDOMTree::Builder()
             .SetBaseAndExtent(old_selection_range)
            .SetIsHandleVisible(is_handle_visible)
             .Build();
     GetFrame().Selection().SetSelection(
        selection,
        SetSelectionData::Builder().SetShouldCloseTyping(true).Build());
     return true;
   }
 
  Element* root_editable_element =
      GetFrame()
          .Selection()
          .ComputeVisibleSelectionInDOMTreeDeprecated()
          .RootEditableElement();
  if (!root_editable_element)
    return false;
  PlainTextRange composition_range =
      PlainTextRange::Create(*root_editable_element, *composition_range_);
  if (composition_range.IsNull())
    return false;

  if (is_too_long) {
    ReplaceComposition(ComposingText());
  } else {
    Clear();
  }

  if (!MoveCaret(composition_range.End()))
    return false;

  DispatchCompositionEndEvent(GetFrame(), composing);
  return true;
}

Vulnerability Type: DoS Overflow 
CWE ID: CWE-119
Summary: The convolution implementation in Skia, as used in Google Chrome before 47.0.2526.73, does not properly constrain row lengths, which allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via crafted graphics data.
Commit Message: Move SelectionTemplate::is_handle_visible_ to FrameSelection

This patch moves |is_handle_visible_| to |FrameSelection| from |SelectionTemplate|
since handle visibility is used only for setting |FrameSelection|, hence it is
a redundant member variable of |SelectionTemplate|.

Bug: 742093
Change-Id: I3add4da3844fb40be34dcb4d4b46b5fa6fed1d7e
Reviewed-on: https://chromium-review.googlesource.com/595389
Commit-Queue: Yoshifumi Inoue <yosin@chromium.org>
Reviewed-by: Xiaocheng Hu <xiaochengh@chromium.org>
Reviewed-by: Kent Tamura <tkent@chromium.org>
Cr-Commit-Position: refs/heads/master@{#491660}