Selection API: deleteFromDocument() should refer to a registered Range.

third_party/WebKit/Source/core/editing/DOMSelection.cpp

Index: third_party/WebKit/Source/core/editing/DOMSelection.cpp
diff --git a/third_party/WebKit/Source/core/editing/DOMSelection.cpp b/third_party/WebKit/Source/core/editing/DOMSelection.cpp
index b359dfe92b8b11a72c3901e13252fe712201355c..3ab419529702509df17ffbfecacbd19b315181d1 100644
--- a/third_party/WebKit/Source/core/editing/DOMSelection.cpp
+++ b/third_party/WebKit/Source/core/editing/DOMSelection.cpp
@@ -648,10 +648,24 @@ void DOMSelection::addRange(Range* newRange) {
                                 UseCounter::SelectionAddRangeIntersect);
 }
 
+// https://www.w3.org/TR/selection-api/#dom-selection-deletefromdocument
 void DOMSelection::deleteFromDocument() {
   if (!isAvailable())
     return;
 
+  // The method must invoke deleteContents() ([DOM4]) on the context object's
+  // range if the context object is not empty. Otherwise the method must do
+  // nothing.
+  if (Range* range = documentCachedRange()) {
+    range->deleteContents(ASSERT_NO_EXCEPTION);
+    return;
+  }
+
+  // The following code is necessary for
+  // editing/selection/deleteFromDocument-crash.html, which assumes
+  // deleteFromDocument() for text selection in a TEXTAREA deletes the TEXTAREA
+  // value.
+
   FrameSelection& selection = frame()->selection();
 
   if (selection.isNone())