Selection API: deleteFromDocument() should refer to a registered Range.

third_party/WebKit/Source/core/editing/DOMSelection.cpp

 /*
  * Copyright (C) 2007, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
@@ skipping 630 matching lines @@
     return;
   }
 
   // TODO(tkent): "Merge the ranges if they intersect" was removed. We show a
   // warning message for a while, and continue to collect the usage data.
   // <https://code.google.com/p/chromium/issues/detail?id=353069>.
   Deprecation::countDeprecation(frame(),
                                 UseCounter::SelectionAddRangeIntersect);
 }
 
+// https://www.w3.org/TR/selection-api/#dom-selection-deletefromdocument
 void DOMSelection::deleteFromDocument() {
   if (!isAvailable())
     return;
 
+  // The method must invoke deleteContents() ([DOM4]) on the context object's
+  // range if the context object is not empty. Otherwise the method must do
+  // nothing.
+  if (Range* range = documentCachedRange()) {
+    range->deleteContents(ASSERT_NO_EXCEPTION);
+    return;
+  }
+
+  // The following code is necessary for
+  // editing/selection/deleteFromDocument-crash.html, which assumes
+  // deleteFromDocument() for text selection in a TEXTAREA deletes the TEXTAREA
+  // value.
+
   FrameSelection& selection = frame()->selection();
 
   if (selection.isNone())
     return;
 
   // TODO(xiaochengh): The use of updateStyleAndLayoutIgnorePendingStylesheets
   // needs to be audited.  See http://crbug.com/590369 for more details.
   // |VisibleSelection::toNormalizedEphemeralRange| requires clean layout.
   frame()->document()->updateStyleAndLayoutIgnorePendingStylesheets();
 
@@ skipping 144 matching lines @@
     m_treeScope->document().addConsoleMessage(
         ConsoleMessage::create(JSMessageSource, ErrorMessageLevel, message));
 }
 
 DEFINE_TRACE(DOMSelection) {
   visitor->trace(m_treeScope);
   ContextClient::trace(visitor);
 }
 
 }  // namespace blink