Introduce Range::dispose() for prompt detachment from owner Document.

Source/web/WebLocalFrameImpl.cpp

 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 238 matching lines @@
 {
     Document* document = frame->document();
     if (!document)
         return;
 
     if (!frame->view())
         return;
 
     // Select the document body.
     RefPtrWillBeRawPtr<Range> range(document->createRange());
+    ScopedDisposal<Range> disposeScope(range);
+
     TrackExceptionState exceptionState;
     range->selectNodeContents(document->body(), exceptionState);

[yosin_UTC9, 2015/09/11 01:22:27]

We can use |EphemeralRange| here.

// ClusterFuzz can changes document w/o body.
if (!document->body())
    return;
const EphemeralRange range = rangeOfContents(*document->body());

[sof, 2015/09/11 06:32:12]

Nice; done, I think.

 
     if (!exceptionState.hadException()) {
         // The text iterator will walk nodes giving us text. This is similar to
         // the plainText() function in core/editing/TextIterator.h, but we implement the maximum
         // size and also copy the results directly into a wstring, avoiding the
         // string conversion.
         for (TextIterator it(range->startPosition(), range->endPosition()); !it.atEnd(); it.advance()) {
             it.text().appendTextToStringBuilder(output, 0, maxChars - output.length());
             if (output.length() >= maxChars)
                 return; // Filled up the buffer.
@@ skipping 1922 matching lines @@
 }
 
 WebSandboxFlags WebLocalFrameImpl::effectiveSandboxFlags() const
 {
     if (!frame())
         return WebSandboxFlags::None;
     return static_cast<WebSandboxFlags>(frame()->loader().effectiveSandboxFlags());
 }
 
 } // namespace blink