Explicit management of FrameSelection availability

third_party/WebKit/Source/core/editing/spellcheck/SpellChecker.cpp

Index: third_party/WebKit/Source/core/editing/spellcheck/SpellChecker.cpp
diff --git a/third_party/WebKit/Source/core/editing/spellcheck/SpellChecker.cpp b/third_party/WebKit/Source/core/editing/spellcheck/SpellChecker.cpp
index fa176f6a239d279acfd1c9a9ded9279efb361b98..f97e73703b3312b7a184cef46a346e29f7b16325 100644
--- a/third_party/WebKit/Source/core/editing/spellcheck/SpellChecker.cpp
+++ b/third_party/WebKit/Source/core/editing/spellcheck/SpellChecker.cpp
@@ -564,8 +564,17 @@ void SpellChecker::markAndReplaceFor(SpellCheckRequest* request, const Vector<Te
 {
     TRACE_EVENT0("blink", "SpellChecker::markAndReplaceFor");
     DCHECK(request);
+    if (!frame().selection().isAvailable()) {
+        // "editing/spelling/spellcheck-async-remove-frame.html" reaches here.
+        return;
+    }
     if (!request->isValid())
         return;
+    if (request->rootEditableElement()->document() != frame().selection().document()) {
+        // we ignore |request| made for another document.
+        // "editing/spelling/spellcheck-sequencenum.html" and others reach here.
+        return;
+    }
 
     TextCheckingTypeMask textCheckingOptions = request->data().mask();
     TextCheckingParagraph paragraph(request->checkingRange(), request->paragraphRange());