Chrome Version: ToT
OS: (e.g. Win7, OSX 10.9.5, etc...)

What steps will reproduce the problem?
(1) Load "data:text/html, foo <wbr> bar" with LayoutNG enabled
(2) Set selection "fo^o <wbr> ba|r" where ^ and | denote selection anchor and focus, respectively
(3) Try copy the selection

What is the expected result?

No crash

What happens instead?

Crash, hitting a NOTREACHED() in LayoutText::PositionForCaretOffset():

LayoutView 0x248762004010              	#document
  LayoutNGBlockFlow 0x248762018010     	HTML
    LayoutNGBlockFlow 0x248762018158   	BODY
      LayoutText 0x2487620281b0        	#text "foo "
*     LayoutWordBreak 0x2487620280e0   	WBR
      LayoutText 0x248762028010        	#text " bar "
[1:1:0212/130111.393750:FATAL:LayoutText.cpp(1990)] Check failed: false. 0
#0 0x7ff5bafa69fd base::debug::StackTrace::StackTrace()
#1 0x7ff5bafa4eec base::debug::StackTrace::StackTrace()
#2 0x7ff5bb02d93a logging::LogMessage::~LogMessage()
#3 0x7ff5b3275356 blink::LayoutText::PositionForCaretOffset()
#4 0x7ff5b3275fc6 blink::LayoutText::ResolvedTextLength()
#5 0x7ff5b29e09f1 blink::(anonymous namespace)::EndOfParagraphAlgorithm<>()
#6 0x7ff5b29ddf99 blink::(anonymous namespace)::EndOfParagraphAlgorithm<>()
#7 0x7ff5b29dde72 blink::EndOfParagraph()
#8 0x7ff5b29deb4b blink::(anonymous namespace)::IsEndOfParagraphAlgorithm<>()
#9 0x7ff5b29dea1a blink::IsEndOfParagraph()
#10 0x7ff5b2a9ff4b blink::NeedInterchangeNewlineAfter<>()
#11 0x7ff5b2aa1cb2 blink::StyledMarkupSerializer<>::CreateMarkup()
#12 0x7ff5b2a9cc42 blink::CreateMarkupAlgorithm<>::CreateMarkup()
#13 0x7ff5b2a99c0a blink::CreateMarkup()