Dispose temporary Range in Selection::collapse

third_party/WebKit/Source/core/editing/DOMSelection.cpp

Index: third_party/WebKit/Source/core/editing/DOMSelection.cpp
diff --git a/third_party/WebKit/Source/core/editing/DOMSelection.cpp b/third_party/WebKit/Source/core/editing/DOMSelection.cpp
index 5b9f4478aeffe04440a068ad91d83ed2e7a5bbb3..1c73eeedc0565ef287fb6d733d629df7b7920849 100644
--- a/third_party/WebKit/Source/core/editing/DOMSelection.cpp
+++ b/third_party/WebKit/Source/core/editing/DOMSelection.cpp
@@ -258,11 +258,15 @@ void DOMSelection::collapse(Node* node,
 
   // 5. Set ([DOM4]) the start and the end of newRange to (node, offset).
   newRange->setStart(node, offset, exceptionState);
-  if (exceptionState.hadException())
+  if (exceptionState.hadException()) {
+    newRange->dispose();
     return;
+  }
   newRange->setEnd(node, offset, exceptionState);
-  if (exceptionState.hadException())
+  if (exceptionState.hadException()) {
+    newRange->dispose();
     return;
+  }
 
   // 6. Set the context object's range to newRange.
   updateFrameSelection(