Fix a use-after-free in spellcheck client

LayoutTests/editing/spelling/resources/util.js

 function log(msg)
 {
     document.getElementById("console").innerHTML += (msg + "\n");
 }
 
 function verifySpellTest(nretry)
 {
     var node = destination;
     if (destination.childNodes.length > 0)
         node = destination.childNodes[0];
@@ skipping 11 matching lines @@
         log("FAIL Incomplete test environment");
         return;
     }
     testFunctionCallback = testFunction;
     jsTestIsAsync = true;
     internals.settings.setAsynchronousSpellCheckingEnabled(true);
     internals.settings.setSmartInsertDeleteEnabled(true);
     internals.settings.setSelectTrailingWhitespaceEnabled(false);
     internals.settings.setUnifiedTextCheckerEnabled(true);
     internals.settings.setEditingBehavior("win");
-    var destination = document.getElementById(testElementId);
+    destination = document.getElementById(testElementId);

[abarth-chromium, 2013/07/17 00:01:00]

Maybe:

window.destination = ...

to make it clear that we're exposing this variable on purpose?

[please use gerrit instead, 2013/07/17 01:11:22]

Done.

     destination.focus();
     document.execCommand("InsertText", false, testText);
     window.setTimeout(function() { verifySpellTest(10); }, 0);
 }