Explicit management of FrameSelection availability

third_party/WebKit/Source/core/page/DragController.cpp

 /*
  * Copyright (C) 2007, 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Google Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 473 matching lines @@
         return fileInput->receiveDroppedFiles(dragData);
     }
 
     if (!m_page->dragController().canProcessDrag(dragData)) {
         m_page->dragCaretController().clear();
         return false;
     }
 
     VisibleSelection dragCaret(m_page->dragCaretController().caretPosition());
     m_page->dragCaretController().clear();
+    // |innerFrame| can be removed by event handler called by
+    // |dispatchTextInputEventFor()|.
+    if (!innerFrame->selection().isAvailable()) {
+        // "editing/pasteboard/drop-text-events-sideeffect-crash.html" reaches
+        // here.
+        return false;
+    }
     Range* range = createRange(dragCaret.toNormalizedEphemeralRange());
     Element* rootEditableElement = innerFrame->selection().rootEditableElement();
 
     // For range to be null a WebKit client must have done something bad while
     // manually controlling drag behaviour
     if (!range)
         return false;
     ResourceFetcher* fetcher = range->ownerDocument().fetcher();
     ResourceCacheValidationSuppressor validationSuppressor(fetcher);
     if (dragIsMove(innerFrame->selection(), dragData) || dragCaret.isContentRichlyEditable()) {
@@ skipping 488 matching lines @@
 
 DEFINE_TRACE(DragController)
 {
     visitor->trace(m_page);
     visitor->trace(m_documentUnderMouse);
     visitor->trace(m_dragInitiator);
     visitor->trace(m_fileInputElementUnderMouse);
 }
 
 } // namespace blink