Explicit management of FrameSelection availability

third_party/WebKit/Source/core/editing/spellcheck/SpellChecker.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 546 matching lines @@
             if (comparePositions(chunkRange.endPosition(), checkRange.endPosition()) < 0)
                 checkRangeIterator.advance(TextIterator::rangeLength(chunkRange.endPosition(), checkRange.endPosition()));
         }
     }
 }
 
 void SpellChecker::markAndReplaceFor(SpellCheckRequest* request, const Vector<TextCheckingResult>& results)
 {
     TRACE_EVENT0("blink", "SpellChecker::markAndReplaceFor");
     DCHECK(request);
+    if (!frame().selection().isAvailable()) {
+        // "editing/spelling/spellcheck-async-remove-frame.html" reaches here.
+        return;
+    }
     if (!request->isValid())
         return;
+    if (request->rootEditableElement()->document() != frame().selection().document()) {
+        // we ignore |request| made for another document.
+        // "editing/spelling/spellcheck-sequencenum.html" and others reach here.
+        return;
+    }
 
     TextCheckingTypeMask textCheckingOptions = request->data().mask();
     TextCheckingParagraph paragraph(request->checkingRange(), request->paragraphRange());
 
     bool shouldMarkSpelling = textCheckingOptions & TextCheckingTypeSpelling;
     bool shouldMarkGrammar = textCheckingOptions & TextCheckingTypeGrammar;
 
     // Expand the range to encompass entire paragraphs, since text checking needs that much context.
     int selectionOffset = 0;
     int ambiguousBoundaryOffset = -1;
@@ skipping 357 matching lines @@
     visitor->trace(m_frame);
     visitor->trace(m_spellCheckRequester);
 }
 
 void SpellChecker::prepareForLeakDetection()
 {
     m_spellCheckRequester->prepareForLeakDetection();
 }
 
 } // namespace blink