Adding a layout update in Editor::appliedEditing before calling changeSelectionAfterCommand fixes the problem. Not sure if this is the right fix, though.

Analysis of the failure of editing/pasteboard/5075944.html:

1. With --enable-blink-features=IdleTimeSpellChecking, Editor::appliedEditing calls Editor::changeSelectionAfterCommand with dirty layout
2. Editor::changeSelectionAfterCommands calls FrameSelection::setSelectionAlgorithm (DOM tree version)
3. SelectionEditor::setVisibleSelection (DOM tree version) is called
4. SelectionAdjuster::adjustSelectionInFlatTree (DOM tree version) is called
5. At the end of the above function, VisibleSelectionTemplate::updateSelectionType is called
6. computeSelectionType is called, which calls mostBackwardCaretPosition

So the root cause of this bug seems to be that mostBackwardCaretPosition is called with dirty layout

There used to be a layout update in Editor::appliedEditing, but I removed it with r426167

I thought the layout update was only needed by spell checker, which turns out to be wrong as FrameSelection::setSelection also needs it.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/a0873eea705ea81161ec71eb3055001920f7b448

commit a0873eea705ea81161ec71eb3055001920f7b448
Author: xiaochengh <xiaochengh@chromium.org>
Date: Wed Jan 11 06:10:35 2017

Convert editing/pasteboard/5075944.html with assert_selection

This patch converts editing/pasteboard/5075944.html with assert_selection
to promote the use of w3c testharness and improve code health.

It is also a preparation for https://codereview.chromium.org/2626933002

BUG= 679616 , 679977

Review-Url: https://codereview.chromium.org/2621213002
Cr-Commit-Position: refs/heads/master@{#442820}

[delete] https://crrev.com/293f4eecd49dd62088f2ba3e12c3fc17eb5e43fd/third_party/WebKit/LayoutTests/editing/pasteboard/5075944.html
[add] https://crrev.com/a0873eea705ea81161ec71eb3055001920f7b448/third_party/WebKit/LayoutTests/editing/pasteboard/copy-paste-underlined.html
[delete] https://crrev.com/293f4eecd49dd62088f2ba3e12c3fc17eb5e43fd/third_party/WebKit/LayoutTests/platform/linux/editing/pasteboard/5075944-expected.png
[delete] https://crrev.com/293f4eecd49dd62088f2ba3e12c3fc17eb5e43fd/third_party/WebKit/LayoutTests/platform/linux/editing/pasteboard/5075944-expected.txt
[delete] https://crrev.com/293f4eecd49dd62088f2ba3e12c3fc17eb5e43fd/third_party/WebKit/LayoutTests/platform/mac/editing/pasteboard/5075944-expected.png
[delete] https://crrev.com/293f4eecd49dd62088f2ba3e12c3fc17eb5e43fd/third_party/WebKit/LayoutTests/platform/mac/editing/pasteboard/5075944-expected.txt
[delete] https://crrev.com/293f4eecd49dd62088f2ba3e12c3fc17eb5e43fd/third_party/WebKit/LayoutTests/platform/win/editing/pasteboard/5075944-expected.png
[delete] https://crrev.com/293f4eecd49dd62088f2ba3e12c3fc17eb5e43fd/third_party/WebKit/LayoutTests/platform/win/editing/pasteboard/5075944-expected.txt

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/c9297ecbd87ae09ce5f315c0ae5718cf9a4aabf0

commit c9297ecbd87ae09ce5f315c0ae5718cf9a4aabf0
Author: xiaochengh <xiaochengh@chromium.org>
Date: Wed Jan 11 12:26:27 2017

Make Editor::appliedEditing update layout before changing selection

Updating frame selection currently requires clean layout, as it calls
mostBackwardCaretPosition through SelectionAdjuster. One code path that
violates it is from Editor::appliedEditing, which is fixed by this patch.

BUG= 679616 

Review-Url: https://codereview.chromium.org/2626933002
Cr-Commit-Position: refs/heads/master@{#442881}

[modify] https://crrev.com/c9297ecbd87ae09ce5f315c0ae5718cf9a4aabf0/third_party/WebKit/LayoutTests/editing/pasteboard/copy-paste-underlined.html
[modify] https://crrev.com/c9297ecbd87ae09ce5f315c0ae5718cf9a4aabf0/third_party/WebKit/Source/core/editing/Editor.cpp

 Issue 699723  has been merged into this issue.

Two tests have flaky crashes:

compositing/overflow/do-not-paint-outline-into-composited-scrolling-contents.html
virtual/prefer_compositing_to_lcd_text/compositing/overflow/do-not-paint-outline-into-composited-scrolling-contents.html

Stack trace:

STDERR: [1:1:0308/131122.789608:1018318194454:FATAL:SimplifiedBackwardsTextIterator.cpp(145)] Check failed: m_positionNode. 
STDERR: #0 0x7fe78fe29bbb base::debug::StackTrace::StackTrace()
STDERR: #1 0x7fe78fe2824c base::debug::StackTrace::StackTrace()
STDERR: #2 0x7fe78fe9673f logging::LogMessage::~LogMessage()
STDERR: #3 0x7fe7864346ba blink::SimplifiedBackwardsTextIteratorAlgorithm<>::advance()
STDERR: #4 0x7fe78642a274 blink::BackwardsCharacterIteratorAlgorithm<>::advance()
STDERR: #5 0x7fe78646c15e blink::(anonymous namespace)::calculateHotModeCheckingRange()
STDERR: #6 0x7fe78646bf36 blink::HotModeSpellCheckRequester::checkSpellingAt()
STDERR: #7 0x7fe78646e29a blink::IdleSpellCheckCallback::hotModeInvocation()
STDERR: #8 0x7fe78646ee4f blink::IdleSpellCheckCallback::handleEvent()
STDERR: #9 0x7fe7862879b4 blink::ScriptedIdleTaskController::runCallback()
STDERR: #10 0x7fe786287567 blink::ScriptedIdleTaskController::callbackFired()
STDERR: #11 0x7fe7862884cd blink::internal::IdleRequestCallbackWrapper::timeoutFired()

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/9ca1914b925d1108499243aeb51dee5d175535af

commit 9ca1914b925d1108499243aeb51dee5d175535af
Author: xiaochengh <xiaochengh@chromium.org>
Date: Thu Mar 09 03:28:48 2017

Correct usage of text iterator in idle time spellchecker

Idle time spell checker used to assume that TextIterator::advance()
is no-op when the iterator is already at end, which is incorrect.

This patch fixes the issue by adding |atEnd()| checks.

Note: When at end, TextIterator::advance() should be no-op but is not.
See crbug.com/699747

BUG= 679616 
TEST=compositing/overflow/do-not-paint-outline-into-composited-scrolling-contents.html

Review-Url: https://codereview.chromium.org/2734393003
Cr-Commit-Position: refs/heads/master@{#455654}

[modify] https://crrev.com/9ca1914b925d1108499243aeb51dee5d175535af/third_party/WebKit/Source/core/editing/spellcheck/HotModeSpellCheckRequester.cpp