Chrome Version: M68
OS: we noticed on both Windows and Linux

What steps will reproduce the problem?
(1) In debug mode, enable the new dropdown
(2) Navigate to a page with a form, and show the popup a few times.

What is the expected result?

The popup should always be shown and hidden according to user actions.

What happens instead?

Sometimes, a DCHECK in the renderer is hit. I tested with the --single-process switch, and captured the following stack trace:

I suspect this is correlated with  crbug.com/835019 , and maybe even  crbug.com/843757  (lastpass regression).

[27432:17936:0518/134600.051:FATAL:inline_box_position.cc(110)] Check failed: caret_offset == inline_box->CaretLeftmostOffset() || caret_offset == inline_box->CaretRightmostOffset().
Backtrace:
        base::debug::StackTrace::StackTrace [0x68F941D6+102]
        base::debug::StackTrace::StackTrace [0x68F92ECB+27]
        logging::LogMessage::~LogMessage [0x69004624+148]
        blink::RootInlineBox::NextRootBox [0x11803E56+278]
        blink::ToLayoutText [0x11803BB3+707]
        blink::ComputeInlineBoxPositionForInlineAdjustedPosition [0x118024B6+1030]
        blink::ComputeInlineBoxPositionForInlineAdjustedPosition [0x118020D4+36]
        blink::ComputeInlineBoxPosition [0x11801104+180]
        blink::ComputeInlineBoxPosition [0x11801074+36]
        blink::RenderedPosition::Create [0x118849F1+145]
        blink::VisiblePositionTemplate<blink::EditingAlgorithm<blink::FlatTreeTraversal> >::VisiblePositionTemplate<blink::EditingAlgorithm<blink::FlatTreeTraversal> > [0x11894DEE+510]
        blink::SelectionController::SetNonDirectionalSelectionIfNeeded [0x118935A4+500]
        blink::SelectionController::UpdateSelectionForMouseDrag [0x1189305B+1211]
        blink::SelectionController::HandleMouseDraggedEvent [0x118966CB+635]
        blink::MouseEventManager::HandleMouseDraggedEvent [0x121382D8+936]
        blink::EventHandler::HandleMouseMoveOrLeaveEvent [0x1211DC67+3351]
        blink::EventHandler::HandleMouseMoveEvent [0x1211CD17+423]
        blink::PageWidgetEventHandler::HandleMouseMove [0x12A4CD6C+172]
        blink::PageWidgetDelegate::HandleInputEvent [0x12A4C75E+1086]
        blink::WebViewImpl::HandleInputEvent [0x11A93F63+2995]
        blink::WebViewFrameWidget::HandleInputEvent [0x11D6938D+45]
        content::RenderWidgetInputHandler::HandleInputEvent [0x55C127B4+2500]
        content::RenderWidget::HandleInputEvent [0x561E4CB8+136]
        content::RenderViewImpl::HandleInputEvent [0x561C34DA+314]
        content::MainThreadEventQueue::HandleEventOnMainThread [0x55C095D5+149]
        content::QueuedWebInputEvent::Dispatch [0x55C09DF2+258]
        content::MainThreadEventQueue::DispatchRafAlignedInput [0x55C09141+657]
        content::RenderWidget::BeginMainFrame [0x561E53A1+161]
        content::RenderWidgetCompositor::BeginMainFrame [0x55B5500D+125]
        cc::LayerTreeHost::BeginMainFrame [0x50F9C3F1+33]
        cc::ProxyMain::BeginMainFrame [0x511175DA+2218]
        base::internal::FunctorTraits<void (__thiscall cc::ProxyMain::*)(std::unique_ptr<cc::BeginMainFrameAndCommitState,std::default_delete<cc::BeginMainFrameAndCommitState> >),void>::Invoke<void (__thiscall cc::ProxyMain::*)(std::unique_ptr<cc::BeginMainFrameA [0x511132C9+105]
        base::internal::InvokeHelper<1,void>::MakeItSo<void (__thiscall cc::ProxyMain::*)(std::unique_ptr<cc::BeginMainFrameAndCommitState,std::default_delete<cc::BeginMainFrameAndCommitState> >),base::WeakPtr<cc::ProxyMain>,std::unique_ptr<cc::BeginMainFrameAndC [0x51113152+130]
        base::internal::Invoker<base::internal::BindState<void (__thiscall cc::ProxyMain::*)(std::unique_ptr<cc::BeginMainFrameAndCommitState,std::default_delete<cc::BeginMainFrameAndCommitState> >),base::WeakPtr<cc::ProxyMain>,base::internal::PassedWrapper<std:: [0x5111304E+126]
        base::internal::Invoker<base::internal::BindState<void (__thiscall cc::ProxyMain::*)(std::unique_ptr<cc::BeginMainFrameAndCommitState,std::default_delete<cc::BeginMainFrameAndCommitState> >),base::WeakPtr<cc::ProxyMain>,base::internal::PassedWrapper<std:: [0x51112E84+84]
        base::OnceCallback<void __cdecl(void)>::Run [0x68F23F00+80]
        base::debug::TaskAnnotator::RunTask [0x68F997A3+1075]
        base::sequence_manager::internal::ThreadControllerImpl::DoWork [0x0BDBCAE7+1239]
        base::internal::FunctorTraits<void (__thiscall base::sequence_manager::internal::ThreadControllerImpl::*)(enum base::sequence_manager::internal::SequencedTaskSource::WorkType),void>::Invoke<void (__thiscall base::sequence_manager::internal::ThreadControll [0x0BDC05E1+81]
        base::internal::InvokeHelper<1,void>::MakeItSo<void (__thiscall base::sequence_manager::internal::ThreadControllerImpl::*const &)(enum base::sequence_manager::internal::SequencedTaskSource::WorkType),base::WeakPtr<base::sequence_manager::internal::ThreadC [0x0BDC0472+146]
        base::internal::Invoker<base::internal::BindState<void (__thiscall base::sequence_manager::internal::ThreadControllerImpl::*)(enum base::sequence_manager::internal::SequencedTaskSource::WorkType),base::WeakPtr<base::sequence_manager::internal::ThreadContr [0x0BDC03AF+111]
        base::internal::Invoker<base::internal::BindState<void (__thiscall base::sequence_manager::internal::ThreadControllerImpl::*)(enum base::sequence_manager::internal::SequencedTaskSource::WorkType),base::WeakPtr<base::sequence_manager::internal::ThreadContr [0x0BDC01CF+63]
        base::OnceCallback<void __cdecl(void)>::Run [0x68F23F00+80]
        base::debug::TaskAnnotator::RunTask [0x68F997A3+1075]
        base::internal::IncomingTaskQueue::RunTask [0x6903F728+232]
        base::MessageLoop::RunTask [0x6904A45B+875]
        base::MessageLoop::DeferOrRunPendingTask [0x6904AEC9+73]
        base::MessageLoop::DoWork [0x6904B18A+442]
        base::MessagePumpForUI::DoRunLoop [0x690595FE+62]
        base::MessagePumpWin::Run [0x69058899+185]
        base::MessageLoop::Run [0x69049C16+486]
        base::RunLoop::Run [0x6913C318+488]
        base::Thread::Run [0x69224FF7+375]
        base::Thread::ThreadMain [0x69225925+1221]
        base::PlatformThread::GetCurrentThreadPriority [0x69215466+1094]
        BaseThreadInitThunk [0x73DE62C4+36]
        RtlSubscribeWnfStateChangeNotification [0x77130FA9+1081]
        RtlSubscribeWnfStateChangeNotification [0x77130F74+1028]