Fix a crash where we would try to add a DocumentMarker with a...

webkit/glue/webframe_impl.cc

 /*
  * Copyright (C) 2006 Samuel Weinig (sam.weinig@gmail.com)
  * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 939 matching lines @@
   for (; !markedText.atEnd(); markedText.advance()) {
     RefPtr<Range> textPiece = markedText.range();
     int exception = 0;
 
     WebCore::DocumentMarker marker = {
         WebCore::DocumentMarker::TextMatch,
         textPiece->startOffset(exception),
         textPiece->endOffset(exception),
         "" };
 
-    // Find the node to add a marker to and add it.
-    Node* node = textPiece->startContainer(exception);
-    frame()->document()->addMarker(node, marker);
+    if (marker.endOffset > marker.startOffset) {
+      // Find the node to add a marker to and add it.
+      Node* node = textPiece->startContainer(exception);
+      frame()->document()->addMarker(node, marker);
 
-    // Rendered rects for markers in WebKit are not populated until each time
-    // the markers are painted. However, we need it to happen sooner, because
-    // the whole purpose of tickmarks on the scrollbar is to show where matches
-    // off-screen are (that haven't been painted yet).
-    Vector<WebCore::DocumentMarker> markers =
-        frame()->document()->markersForNode(node);
-    frame()->document()->setRenderedRectForMarker(
-        textPiece->startContainer(exception),
-        markers[markers.size() - 1],
-        range->boundingBox());
+      // Rendered rects for markers in WebKit are not populated until each time
+      // the markers are painted. However, we need it to happen sooner, because
+      // the whole purpose of tickmarks on the scrollbar is to show where
+      // matches off-screen are (that haven't been painted yet).
+      Vector<WebCore::DocumentMarker> markers =
+          frame()->document()->markersForNode(node);
+      frame()->document()->setRenderedRectForMarker(
+          textPiece->startContainer(exception),
+          markers[markers.size() - 1],
+          range->boundingBox());
+    }
   }
 }
 
 void WebFrameImpl::ScopeStringMatches(FindInPageRequest request,
                                       bool reset) {
   if (!ShouldScopeMatches(request))
     return;
 
   WebFrameImpl* main_frame_impl =
       static_cast<WebFrameImpl*>(GetView()->GetMainFrame());
@@ skipping 28 matching lines @@
   RefPtr<Range> search_range(rangeOfContents(frame()->document()));
 
   ExceptionCode ec = 0, ec2 = 0;
   if (!reset && resume_scoping_from_range_.get()) {
     // This is a continuation of a scoping operation that timed out and didn't
     // complete last time around, so we should start from where we left off.
     search_range->setStart(resume_scoping_from_range_->startContainer(),
                            resume_scoping_from_range_->startOffset(ec2) + 1,
                            ec);
     if (ec != 0 || ec2 != 0) {
-      NOTREACHED();
+      if (ec2 != 0)  // A non-zero |ec| happens when navigating during search.
+        NOTREACHED();
       return;
     }
   }
 
   // This timeout controls how long we scope (in ms) before releasing control.
   // This value does not prevent us from running for longer than this, but it
   // is periodically checked to see if we have exceeded our allocated time.
   static const int kTimeout = 100;  // ms
 
   int match_count = 0;
@@ skipping 791 matching lines @@
   return password_listeners_.get(input_element);
 }
 
 void WebFrameImpl::ClearPasswordListeners() {
   for (PasswordListenerMap::iterator iter = password_listeners_.begin();
        iter != password_listeners_.end(); ++iter) {
     delete iter->second;
   }
   password_listeners_.clear();
 }