Dispose temporary Range in Selection::collapse

third_party/WebKit/Source/core/editing/DOMSelection.cpp

 /*
  * Copyright (C) 2007, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
@@ skipping 240 matching lines @@
   // 3. If node's root is not the document associated with the context object,
   // abort these steps.
   if (!isValidForPosition(node))
     return;
 
   // 4. Otherwise, let newRange be a new range.
   Range* newRange = Range::create(*frame()->document());
 
   // 5. Set ([DOM4]) the start and the end of newRange to (node, offset).
   newRange->setStart(node, offset, exceptionState);
-  if (exceptionState.hadException())
+  if (exceptionState.hadException()) {
+    newRange->dispose();
     return;
+  }
   newRange->setEnd(node, offset, exceptionState);
-  if (exceptionState.hadException())
+  if (exceptionState.hadException()) {
+    newRange->dispose();
     return;
+  }
 
   // 6. Set the context object's range to newRange.
   updateFrameSelection(
       SelectionInDOMTree::Builder()
           .collapse(Position(node, offset))
           .setIsDirectional(frame()->selection().isDirectional())
           .build(),
       newRange);
 }
 
@@ skipping 538 matching lines @@
     m_treeScope->document().addConsoleMessage(
         ConsoleMessage::create(JSMessageSource, ErrorMessageLevel, message));
 }
 
 DEFINE_TRACE(DOMSelection) {
   visitor->trace(m_treeScope);
   ContextClient::trace(visitor);
 }
 
 }  // namespace blink