Fix selection related crash in debug build.

content/renderer/render_view_impl.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/render_view_impl.h"
 
 #include <algorithm>
 #include <cmath>
 #include <string>
 #include <vector>
@@ skipping 3245 matching lines @@
       offset = location - kExtraCharsBeforeAndAfterSelection;
     else
       offset = 0;
     length = location + length - offset + kExtraCharsBeforeAndAfterSelection;
     WebRange webrange = WebRange::fromDocumentRange(frame, offset, length);
     if (!webrange.isNull())
       text = WebRange::fromDocumentRange(frame, offset, length).toPlainText();
   } else {
     offset = location;
     text = frame->selectionAsText();
+    // http://crbug.com/101435
+    // In some case, frame->selectionAsText() returned text's length is not
+    // equal to the length returned from webview()->caretOrSelectionRange().
+    // So we have to set the range according to text.length().
+    range.set_end(range.start() + text.length());

[James Su, 2011/10/28 22:05:26]

I'm wondering in which case they are not equal?

   }
 
   // Sometimes we get repeated didChangeSelection calls from webkit when
   // the selection hasn't actually changed. We don't want to report these
   // because it will cause us to continually claim the X clipboard.
   if (selection_text_offset_ != offset ||
       selection_range_ != range ||
       selection_text_ != text) {
     selection_text_ = text;
     selection_text_offset_ = offset;
@@ skipping 1391 matching lines @@
   return webview()->settings()->useThreadedCompositor();
 }
 
 void RenderViewImpl::OnJavaBridgeInit(
     const IPC::ChannelHandle& channel_handle) {
   DCHECK(!java_bridge_dispatcher_.get());
 #if defined(ENABLE_JAVA_BRIDGE)
   java_bridge_dispatcher_.reset(new JavaBridgeDispatcher(this, channel_handle));
 #endif
 }