Fix a use-after-free in spellcheck client

LayoutTests/editing/spelling/resources/util.js

Index: LayoutTests/editing/spelling/resources/util.js
diff --git a/LayoutTests/editing/spelling/resources/util.js b/LayoutTests/editing/spelling/resources/util.js
index a178e06ba6d7fa50d10329ccf2f26dcd97dc9a60..7779d1ddecd0530edb2c5146691939e355bdf53b 100644
--- a/LayoutTests/editing/spelling/resources/util.js
+++ b/LayoutTests/editing/spelling/resources/util.js
@@ -29,7 +29,7 @@ function initSpellTest(testElementId, testText, testFunction)
     internals.settings.setSelectTrailingWhitespaceEnabled(false);
     internals.settings.setUnifiedTextCheckerEnabled(true);
     internals.settings.setEditingBehavior("win");
-    var destination = document.getElementById(testElementId);
+    destination = document.getElementById(testElementId);

[abarth-chromium, 2013/07/17 00:01:00]

Maybe:

window.destination = ...

to make it clear that we're exposing this variable on purpose?

[please use gerrit instead, 2013/07/17 01:11:22]

Done.

     destination.focus();
     document.execCommand("InsertText", false, testText);
     window.setTimeout(function() { verifySpellTest(10); }, 0);