Explicit management of FrameSelection availability

third_party/WebKit/Source/core/editing/DOMSelection.cpp

Index: third_party/WebKit/Source/core/editing/DOMSelection.cpp
diff --git a/third_party/WebKit/Source/core/editing/DOMSelection.cpp b/third_party/WebKit/Source/core/editing/DOMSelection.cpp
index 241a657bcd771c2e12fa78ef6126ef94308c2891..cdc69cee04afe11f8fc7636b43acebdfd256224b 100644
--- a/third_party/WebKit/Source/core/editing/DOMSelection.cpp
+++ b/third_party/WebKit/Source/core/editing/DOMSelection.cpp
@@ -81,7 +81,7 @@ void DOMSelection::clearTreeScope()
 
 bool DOMSelection::isAvailable() const
 {
-    return m_frame;
+    return m_frame && m_frame->selection().isAvailable();
 }
 
 const VisibleSelection& DOMSelection::visibleSelection() const
@@ -424,6 +424,11 @@ void DOMSelection::addRange(Range* newRange)
 
     FrameSelection& selection = m_frame->selection();
 
+    if (newRange->ownerDocument() != selection.document()) {
+        // "editing/selection/selection-in-iframe-removed-crash.html" goes here.
+        return;
+    }
+
     if (selection.isNone()) {
         selection.setSelectedRange(newRange, VP_DEFAULT_AFFINITY);
         return;