DOM: Fix moveBefore() selection directionality crash
Before this CL, the added test would have crashed, due to this DCHECK
1. Basically, by not doing ANY work during a moveBefore() selection
change, some internal state was not being updated, and when the
directionality of a selection changed, the next time the selection
tried to render, we'd hit this DCHECK which would be out-of-date, not
expecting the current post-move directionality.
This CL fixes that bug in the selection code, and adds a test for it.
R=masonf
Bug: 40150299
Change-Id: I2a40b167b5e28e984b2a7ef0131f2469819809b1
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5979011
Commit-Queue: Dominic Farolino dom@chromium.org
Reviewed-by: Mason Freed masonf@chromium.org
Cr-Commit-Position: refs/heads/main@{#1376067}