Explicit management of FrameSelection availability

third_party/WebKit/Source/core/editing/DOMSelection.cpp

 /*
  * Copyright (C) 2007, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
@@ skipping 63 matching lines @@
 {
 }
 
 void DOMSelection::clearTreeScope()
 {
     m_treeScope = nullptr;
 }
 
 bool DOMSelection::isAvailable() const
 {
-    return m_frame;
+    return m_frame && m_frame->selection().isAvailable();
 }
 
 const VisibleSelection& DOMSelection::visibleSelection() const
 {
     DCHECK(m_frame);
     return m_frame->selection().selection();
 }
 
 static Position anchorPosition(const VisibleSelection& selection)
 {
@@ skipping 322 matching lines @@
     if (newRange->ownerDocument() != m_frame->document())
         return;
 
     if (!newRange->inShadowIncludingDocument()) {
         addConsoleError("The given range isn't in document.");
         return;
     }
 
     FrameSelection& selection = m_frame->selection();
 
+    if (newRange->ownerDocument() != selection.document()) {
+        // "editing/selection/selection-in-iframe-removed-crash.html" goes here.
+        return;
+    }
+
     if (selection.isNone()) {
         selection.setSelectedRange(newRange, VP_DEFAULT_AFFINITY);
         return;
     }
 
     Range* originalRange = selection.firstRange();
 
     if (originalRange->startContainer()->document() != newRange->startContainer()->document()) {
         addConsoleError("The given range does not belong to the current selection's document.");
         return;
@@ skipping 144 matching lines @@
         m_treeScope->document().addConsoleMessage(ConsoleMessage::create(JSMessageSource, ErrorMessageLevel, message));
 }
 
 DEFINE_TRACE(DOMSelection)
 {
     visitor->trace(m_treeScope);
     DOMWindowProperty::trace(visitor);
 }
 
 } // namespace blink