Fix a crash related to detaching a frame embedding pepper plugin with selection

third_party/WebKit/Source/web/WebFrameWidgetImpl.cpp

 /*
  * Copyright (C) 2014 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 578 matching lines @@
 }
 
 // TODO(ekaramad):This method is almost duplicated in WebViewImpl as well. This
 // code needs to be refactored  (http://crbug.com/629721).
 bool WebFrameWidgetImpl::SelectionBounds(WebRect& anchor,
                                          WebRect& focus) const {
   const LocalFrame* local_frame = FocusedLocalFrameInWidget();
   if (!local_frame)
     return false;
 
+  FrameSelection& selection = local_frame->Selection();
+  if (!selection.IsAvailable() || selection.GetSelectionInDOMTree().IsNone())
+    return false;
+
   // TODO(editing-dev): The use of updateStyleAndLayoutIgnorePendingStylesheets
   // needs to be audited.  See http://crbug.com/590369 for more details.
   local_frame->GetDocument()->UpdateStyleAndLayoutIgnorePendingStylesheets();
 
   DocumentLifecycle::DisallowTransitionScope disallow_transition(
       local_frame->GetDocument()->Lifecycle());
 
-  FrameSelection& selection = local_frame->Selection();
   if (selection.ComputeVisibleSelectionInDOMTree().IsNone())
     return false;
 
   if (selection.ComputeVisibleSelectionInDOMTree().IsCaret()) {
     anchor = focus = selection.AbsoluteCaretBounds();
   } else {
     const EphemeralRange selected_range =
         selection.ComputeVisibleSelectionInDOMTree()
             .ToNormalizedEphemeralRange();
     if (selected_range.IsNull())
@@ skipping 18 matching lines @@
 }
 
 // TODO(ekaramad):This method is almost duplicated in WebViewImpl as well. This
 // code needs to be refactored  (http://crbug.com/629721).
 bool WebFrameWidgetImpl::SelectionTextDirection(WebTextDirection& start,
                                                 WebTextDirection& end) const {
   const LocalFrame* frame = FocusedLocalFrameInWidget();
   if (!frame)
     return false;
 
+  FrameSelection& selection = frame->Selection();
+  if (!selection.IsAvailable())
+    return false;
+
   // TODO(editing-dev): The use of updateStyleAndLayoutIgnorePendingStylesheets
   // needs to be audited.  See http://crbug.com/590369 for more details.
   frame->GetDocument()->UpdateStyleAndLayoutIgnorePendingStylesheets();
 
-  FrameSelection& selection = frame->Selection();
   if (selection.ComputeVisibleSelectionInDOMTree()
           .ToNormalizedEphemeralRange()
           .IsNull())
     return false;
   start = ToWebTextDirection(PrimaryDirectionOf(
       *selection.ComputeVisibleSelectionInDOMTree().Start().AnchorNode()));
   end = ToWebTextDirection(PrimaryDirectionOf(
       *selection.ComputeVisibleSelectionInDOMTree().end().AnchorNode()));
   return true;
 }
 
 // TODO(ekaramad):This method is almost duplicated in WebViewImpl as well. This
 // code needs to be refactored  (http://crbug.com/629721).
 bool WebFrameWidgetImpl::IsSelectionAnchorFirst() const {
   if (const LocalFrame* frame = FocusedLocalFrameInWidget()) {
-    return frame->Selection()
-        .ComputeVisibleSelectionInDOMTreeDeprecated()
-        .IsBaseFirst();
+    FrameSelection& selection = frame->Selection();
+    return selection.IsAvailable() &&
+           selection.ComputeVisibleSelectionInDOMTreeDeprecated().IsBaseFirst();
   }
   return false;
 }
 
 // TODO(ekaramad):This method is almost duplicated in WebViewImpl as well. This
 // code needs to be refactored  (http://crbug.com/629721).
 WebRange WebFrameWidgetImpl::CaretOrSelectionRange() {
   LocalFrame* focused = FocusedLocalFrameInWidget();
   if (!focused)
     return WebRange();
@@ skipping 517 matching lines @@
              : nullptr;
 }
 
 LocalFrame* WebFrameWidgetImpl::FocusedLocalFrameAvailableForIme() const {
   if (!ime_accept_events_)
     return nullptr;
   return FocusedLocalFrameInWidget();
 }
 
 }  // namespace blink