While working on issue 751408 we discovered that BackwardsCharacterIterator seems to go forward instead of backwards in the following situation.

DOM:

BODY
  INPUT
    #shadow-root
*     DIV id="inner-editor" (editable)
        #text "John Smith"

After construction in
https://cs.chromium.org/chromium/src/third_party/WebKit/Source/core/editing/SurroundingText.cpp?rcl=479876aacce1dedb39056a43c97d0777103a7eb6&l=94

backwards_iterator.EndPosition() is
  DIV id="inner-editor" (editable)@offsetInAnchor[0]

after Advance() it becomes
  #text "John Smith"@offsetInAnchor[0]

which comes after. Later this causes breakage in TextIterator constructor that requires that start <= end.