Chrome Version: ToT (65.0.3310.0)
OS: all

SelectionEditor assumes that the frame's VisibleSelection can be uniquely determined from DOM tree and style, and hence, doesn't clear its cached VisibleSelection as long as no DOM/style change happens. This isn't true when there are <object> elements, if the following happens:

0. Let there be an <object> element whose fallback content isn't rendered yet
1. Let SelectionEditor compute cache a VisibleSelection
2. Render the <object> element's fallback content, which changes layout without changing DOM or style
3. Now SelectionEditor caches a stale VS!

Reproducible with unit test:

TEST_F(FrameSelectionTest, FallbackContentAndStaleVisibleSelection) {
  SetBodyContent("<object>x</object>");
  
  // The bug repros only with nested HTML elements
  Node* document_element = GetDocument().documentElement();
  Node* clone = document_element->cloneNode(true, ASSERT_NO_EXCEPTION);
  document_element->replaceChild(clone, GetDocument().body());
  UpdateAllLifecyclePhases();
  
  Position base = Position::FirstPositionInNode(*document_element);
  Position extent = Position::LastPositionInNode(*document_element);
  Selection().SetSelection(SelectionInDOMTree::Builder()
                               .SetBaseAndExtent(base, extent)
                               .SetIsDirectional(true)
                               .Build());
  
  // Compute and cache a VisibleSelection
  Selection().ComputeVisibleSelectionInDOMTree();
  
  Element* object = GetDocument().QuerySelector("object");

  // This renders the fallback content of |object| and invalidates layout,
  // without changing DOM or style version.
  ToHTMLPlugInElement(object)->UpdatePlugin();
  UpdateAllLifecyclePhases();

  VisibleSelection cached = Selection().ComputeVisibleSelectionInDOMTree();
  VisibleSelection fresh =
      CreateVisibleSelection(Selection().GetSelectionInDOMTree());
  
  EXPECT_EQ(cached, fresh); // Fails here!
}