| Index: third_party/WebKit/Source/core/layout/LayoutInline.cpp
 | 
| diff --git a/third_party/WebKit/Source/core/layout/LayoutInline.cpp b/third_party/WebKit/Source/core/layout/LayoutInline.cpp
 | 
| index e001e747cceb74256b483631e590d1d8dce3a8ba..e8ae8c9767e4fcddadd6b8235676787b81471078 100644
 | 
| --- a/third_party/WebKit/Source/core/layout/LayoutInline.cpp
 | 
| +++ b/third_party/WebKit/Source/core/layout/LayoutInline.cpp
 | 
| @@ -76,6 +76,13 @@
 | 
|  
 | 
|    if (!DocumentBeingDestroyed()) {
 | 
|      if (FirstLineBox()) {
 | 
| +      // We can't wait for LayoutBoxModelObject::destroy to clear the selection,
 | 
| +      // because by then we will have nuked the line boxes.
 | 
| +      // FIXME: The FrameSelection should be responsible for this when it
 | 
| +      // is notified of DOM mutations.
 | 
| +      if (IsSelectionBorder())
 | 
| +        View()->ClearSelection();
 | 
| +
 | 
|        // If line boxes are contained inside a root, that means we're an inline.
 | 
|        // In that case, we need to remove all the line boxes so that the parent
 | 
|        // lines aren't pointing to deleted children. If the first line box does
 | 
| 
 |