| Index: third_party/WebKit/Source/core/page/DragController.cpp
|
| diff --git a/third_party/WebKit/Source/core/page/DragController.cpp b/third_party/WebKit/Source/core/page/DragController.cpp
|
| index 3b559f9366ee8eba8cf1cfd56db82e9e2adfc328..819283e3f69b83e1460c4d55018a57ad47d5a4f1 100644
|
| --- a/third_party/WebKit/Source/core/page/DragController.cpp
|
| +++ b/third_party/WebKit/Source/core/page/DragController.cpp
|
| @@ -491,6 +491,13 @@ bool DragController::concludeEditDrag(DragData* dragData)
|
|
|
| VisibleSelection dragCaret(m_page->dragCaretController().caretPosition());
|
| m_page->dragCaretController().clear();
|
| + // |innerFrame| can be removed by event handler called by
|
| + // |dispatchTextInputEventFor()|.
|
| + if (!innerFrame->selection().isAvailable()) {
|
| + // "editing/pasteboard/drop-text-events-sideeffect-crash.html" reaches
|
| + // here.
|
| + return false;
|
| + }
|
| Range* range = createRange(dragCaret.toNormalizedEphemeralRange());
|
| Element* rootEditableElement = innerFrame->selection().rootEditableElement();
|
|
|
|
|